./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor1058279315

<...>
Warning: Permanently added '10.128.0.74' (ED25519) to the list of known hosts.
execve("./syz-executor1058279315", ["./syz-executor1058279315"], 0x7ffceaca3e90 /* 10 vars */) = 0
brk(NULL)                               = 0x555556ed0000
brk(0x555556ed0d40)                     = 0x555556ed0d40
arch_prctl(ARCH_SET_FS, 0x555556ed03c0) = 0
set_tid_address(0x555556ed0690)         = 5033
set_robust_list(0x555556ed06a0, 24)     = 0
rseq(0x555556ed0ce0, 0x20, 0, 0x53053053) = 0
prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0
readlink("/proc/self/exe", "/root/syz-executor1058279315", 4096) = 28
getrandom("\x07\x88\xe3\xd1\xd6\xf5\xfb\x51", 8, GRND_NONBLOCK) = 8
brk(NULL)                               = 0x555556ed0d40
brk(0x555556ef1d40)                     = 0x555556ef1d40
brk(0x555556ef2000)                     = 0x555556ef2000
mprotect(0x7fd4b8d14000, 16384, PROT_READ) = 0
mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000
mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000
mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000
unshare(CLONE_NEWPID)                   = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556ed0690) = 5034
./strace-static-x86_64: Process 5034 attached
[pid  5034] set_robust_list(0x555556ed06a0, 24) = 0
[pid  5034] mount(NULL, "/sys/fs/fuse/connections", "fusectl", 0, NULL) = -1 EBUSY (Device or resource busy)
[pid  5034] socket(AF_BLUETOOTH, SOCK_RAW, BTPROTO_HCI) = 3
[pid  5034] openat(AT_FDCWD, "/dev/vhci", O_RDWR) = 4
[pid  5034] dup2(4, 202)                = 202
[pid  5034] close(4)                    = 0
[pid  5034] write(202, "\xff\x00", 2)   = 2
[pid  5034] read(202, "\xff\x00\x00\x00", 4) = 4
[pid  5034] rt_sigaction(SIGRT_1, {sa_handler=0x7fd4b8cb5d80, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7fd4b8ca7400}, NULL, 8) = 0
[pid  5034] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0
[pid  5034] mmap(NULL, 8392704, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7fd4b8450000
[pid  5034] mprotect(0x7fd4b8451000, 8388608, PROT_READ|PROT_WRITE) = 0
[pid  5034] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
[pid  5034] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7fd4b8c50990, parent_tid=0x7fd4b8c50990, exit_signal=0, stack=0x7fd4b8450000, stack_size=0x800300, tls=0x7fd4b8c506c0} => {parent_tid=[2]}, 88) = 2
[pid  5034] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid  5034] ioctl(3, HCIDEVUP./strace-static-x86_64: Process 5037 attached
 <unfinished ...>
[pid  5037] rseq(0x7fd4b8c50fe0, 0x20, 0, 0x53053053) = 0
[pid  5037] set_robust_list(0x7fd4b8c509a0, 24) = 0
[pid  5037] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid  5037] read(202, "\x01\x03\x0c\x00", 1024) = 4
[pid  5037] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x0e\xfc", iov_len=2}, {iov_base="\x01\x03\x0c", iov_len=3}, {iov_base="\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., iov_len=249}], 4) = 255
[pid  5037] read(202, "\x01\x03\x10\x00", 1024) = 4
[pid  5037] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x0e\xfc", iov_len=2}, {iov_base="\x01\x03\x10", iov_len=3}, {iov_base="\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., iov_len=249}], 4) = 255
[pid  5037] read(202, "\x01\x01\x10\x00", 1024) = 4
[pid  5037] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x0e\xfc", iov_len=2}, {iov_base="\x01\x01\x10", iov_len=3}, {iov_base="\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., iov_len=249}], 4) = 255
[pid  5037] read(202, "\x01\x09\x10\x00", 1024) = 4
[pid  5037] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x0e\x0a", iov_len=2}, {iov_base="\x01\x09\x10", iov_len=3}, {iov_base="\x00\xaa\xaa\xaa\xaa\xaa\xaa", iov_len=7}], 4) = 13
[pid  5037] read(202, "\x01\x05\x10\x00", 1024) = 4
[pid  5037] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x0e\x0b", iov_len=2}, {iov_base="\x01\x05\x10", iov_len=3}, {iov_base="\x00\xfd\x03\x60\x04\x00\x06\x00", iov_len=8}], 4) = 14
[pid  5037] read(202, "\x01\x23\x0c\x00", 1024) = 4
[pid  5037] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x0e\xfc", iov_len=2}, {iov_base="\x01\x23\x0c", iov_len=3}, {iov_base="\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., iov_len=249}], 4) = 255
[pid  5037] read(202, "\x01\x14\x0c\x00", 1024) = 4
[pid  5037] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x0e\xfc", iov_len=2}, {iov_base="\x01\x14\x0c", iov_len=3}, {iov_base="\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., iov_len=249}], 4) = 255
[pid  5037] read(202, "\x01\x25\x0c\x00", 1024) = 4
[pid  5037] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x0e\xfc", iov_len=2}, {iov_base="\x01\x25\x0c", iov_len=3}, {iov_base="\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., iov_len=249}], 4) = 255
[pid  5037] read(202, "\x01\x38\x0c\x00", 1024) = 4
[pid  5037] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x0e\xfc", iov_len=2}, {iov_base="\x01\x38\x0c", iov_len=3}, {iov_base="\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., iov_len=249}], 4) = 255
[pid  5037] read(202, "\x01\x39\x0c\x00", 1024) = 4
[pid  5037] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x0e\xfc", iov_len=2}, {iov_base="\x01\x39\x0c", iov_len=3}, {iov_base="\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., iov_len=249}], 4) = 255
[pid  5037] read(202, "\x01\x16\x0c\x02\x00\x7d", 1024) = 6
[pid  5037] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x0e\xfc", iov_len=2}, {iov_base="\x01\x16\x0c", iov_len=3}, {iov_base="\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., iov_len=249}], 4) = 255
[pid  5037] read(202,  <unfinished ...>
[pid  5034] <... ioctl resumed>, 0)     = -1 EALREADY (Operation already in progress)
[pid  5034] ioctl(3, HCISETSCAN <unfinished ...>
[pid  5037] <... read resumed>"\x01\x1a\x0c\x01\x02", 1024) = 5
[pid  5037] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x0e\x04", iov_len=2}, {iov_base="\x01\x1a\x0c", iov_len=3}, {iov_base="\x00", iov_len=1}], 4) = 7
[pid  5037] rt_sigprocmask(SIG_BLOCK, ~[RT_1], NULL, 8) = 0
[pid  5037] madvise(0x7fd4b8450000, 8372224, MADV_DONTNEED) = 0
[pid  5037] exit(0)                     = ?
[pid  5037] +++ exited with 0 +++
[pid  5034] <... ioctl resumed>, 0x7ffd308aaf4c) = 0
[pid  5034] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x04\x0a", iov_len=2}, {iov_base="\xaa\xaa\xaa\xaa\xaa\x10\x00\x00\x00\x01", iov_len=10}], 3) = 13
[pid  5034] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x03\x0b", iov_len=2}, {iov_base="\x00\xc8\x00\xaa\xaa\xaa\xaa\xaa\x10\x01\x00", iov_len=11}], 3) = 14
[pid  5034] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\v\v", iov_len=2}, {iov_base="\x00\xc8\x00\x00\x00\x00\x00\x00\x00\x00\x00", iov_len=11}], 3) = 14
[pid  5034] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x3e\x13", iov_len=2}, {iov_base="\x01\x00\xc9\x00\x01\x00\xaa\xaa\xaa\xaa\xaa\x11\x00\x00\x00\x00\x00\x00\x00", iov_len=19}], 3) = 22
[pid  5034] close(3)                    = 0
[pid  5034] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5034] setsid()                    = 1
[pid  5034] openat(AT_FDCWD, "/proc/self/ns/net", O_RDONLY) = 3
[pid  5034] dup2(3, 201)                = 201
[pid  5034] close(3)                    = 0
[pid  5034] prlimit64(0, RLIMIT_AS, {rlim_cur=204800*1024, rlim_max=204800*1024}, NULL) = 0
[pid  5034] prlimit64(0, RLIMIT_MEMLOCK, {rlim_cur=32768*1024, rlim_max=32768*1024}, NULL) = 0
[pid  5034] prlimit64(0, RLIMIT_FSIZE, {rlim_cur=139264*1024, rlim_max=139264*1024}, NULL) = 0
[pid  5034] prlimit64(0, RLIMIT_STACK, {rlim_cur=1024*1024, rlim_max=1024*1024}, NULL) = 0
[pid  5034] prlimit64(0, RLIMIT_CORE, {rlim_cur=131072*1024, rlim_max=131072*1024}, NULL) = 0
[pid  5034] prlimit64(0, RLIMIT_NOFILE, {rlim_cur=256, rlim_max=256}, NULL) = 0
[pid  5034] unshare(CLONE_NEWNS)        = 0
[pid  5034] mount(NULL, "/", NULL, MS_REC|MS_PRIVATE, NULL) = 0
[pid  5034] unshare(CLONE_NEWIPC)       = 0
[pid  5034] unshare(CLONE_NEWCGROUP)    = 0
[pid  5034] unshare(CLONE_NEWUTS)       = 0
[pid  5034] unshare(CLONE_SYSVSEM)      = 0
[pid  5034] openat(AT_FDCWD, "/proc/sys/kernel/shmmax", O_WRONLY|O_CLOEXEC) = 3
[pid  5034] write(3, "16777216", 8)     = 8
[pid  5034] close(3)                    = 0
[pid  5034] openat(AT_FDCWD, "/proc/sys/kernel/shmall", O_WRONLY|O_CLOEXEC) = 3
[pid  5034] write(3, "536870912", 9)    = 9
[pid  5034] close(3)                    = 0
[pid  5034] openat(AT_FDCWD, "/proc/sys/kernel/shmmni", O_WRONLY|O_CLOEXEC) = 3
[pid  5034] write(3, "1024", 4)         = 4
[pid  5034] close(3)                    = 0
[pid  5034] openat(AT_FDCWD, "/proc/sys/kernel/msgmax", O_WRONLY|O_CLOEXEC) = 3
[pid  5034] write(3, "8192", 4)         = 4
[pid  5034] close(3)                    = 0
[pid  5034] openat(AT_FDCWD, "/proc/sys/kernel/msgmni", O_WRONLY|O_CLOEXEC) = 3
[pid  5034] write(3, "1024", 4)         = 4
[pid  5034] close(3)                    = 0
[pid  5034] openat(AT_FDCWD, "/proc/sys/kernel/msgmnb", O_WRONLY|O_CLOEXEC) = 3
[   72.464840][ T5036] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[   72.472931][ T5036] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[   72.481062][ T5036] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[   72.491076][ T5036] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[   72.500078][ T5036] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3
[   72.508106][ T5036] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[pid  5034] write(3, "1024", 4)         = 4
[pid  5034] close(3)                    = 0
[pid  5034] openat(AT_FDCWD, "/proc/sys/kernel/sem", O_WRONLY|O_CLOEXEC) = 3
[pid  5034] write(3, "1024 1048576 500 1024", 21) = 21
[pid  5034] close(3)                    = 0
[pid  5034] getpid()                    = 1
[pid  5034] capget({version=_LINUX_CAPABILITY_VERSION_3, pid=1}, {effective=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PTRACE|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_NICE|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ|1<<CAP_PERFMON|1<<CAP_BPF|1<<CAP_CHECKPOINT_RESTORE, permitted=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PTRACE|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_NICE|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ|1<<CAP_PERFMON|1<<CAP_BPF|1<<CAP_CHECKPOINT_RESTORE, inheritable=0}) = 0
[pid  5034] capset({version=_LINUX_CAPABILITY_VERSION_3, pid=1}, {effective=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ|1<<CAP_PERFMON|1<<CAP_BPF|1<<CAP_CHECKPOINT_RESTORE, permitted=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ|1<<CAP_PERFMON|1<<CAP_BPF|1<<CAP_CHECKPOINT_RESTORE, inheritable=0}) = 0
[pid  5034] unshare(CLONE_NEWNET)       = 0
[pid  5034] openat(AT_FDCWD, "/proc/sys/net/ipv4/ping_group_range", O_WRONLY|O_CLOEXEC) = 3
[pid  5034] write(3, "0 65535", 7)      = 7
[pid  5034] close(3)                    = 0
[pid  5034] mkdir("/dev/binderfs", 0777) = 0
[pid  5034] mount("binder", "/dev/binderfs", "binder", 0, NULL) = 0
[pid  5034] symlink("/dev/binderfs", "./binderfs") = 0
[pid  5034] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5039 attached
, child_tidptr=0x555556ed0690) = 3
[pid  5039] set_robust_list(0x555556ed06a0, 24) = 0
[pid  5039] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5039] setpgid(0, 0)               = 0
[pid  5039] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5039] write(3, "1000", 4)         = 4
[pid  5039] close(3)                    = 0
[pid  5039] openat(AT_FDCWD, "/proc/self/ns/net", O_RDONLY) = 3
[pid  5039] setns(201, 0)               = 0
[pid  5039] socket(AF_BLUETOOTH, SOCK_STREAM, BTPROTO_RFCOMM) = 4
[pid  5039] setns(3, 0)                 = 0
[pid  5039] close(3)                    = 0
[   74.554141][ T5036] Bluetooth: hci0: command 0x0409 tx timeout
[   76.644026][ T5036] Bluetooth: hci0: command 0x041b tx timeout
[pid  5039] connect(4, {sa_family=AF_BLUETOOTH, rc_bdaddr=ff:ff:ff:ff:ff:ff, rc_channel=8}, 10 <unfinished ...>
[pid  5034] kill(-3, SIGKILL <unfinished ...>
[pid  5039] <... connect resumed>)      = ?
[pid  5034] <... kill resumed>)         = 0
[pid  5034] kill(3, SIGKILL)            = 0
[pid  5039] +++ killed by SIGKILL +++
[pid  5034] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=3, si_uid=0, si_status=SIGKILL, si_utime=0, si_stime=0} ---
[pid  5034] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5040 attached
, child_tidptr=0x555556ed0690) = 4
[pid  5040] set_robust_list(0x555556ed06a0, 24) = 0
[pid  5040] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5040] setpgid(0, 0)               = 0
[pid  5040] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5040] write(3, "1000", 4)         = 4
[pid  5040] close(3)                    = 0
[pid  5040] openat(AT_FDCWD, "/proc/self/ns/net", O_RDONLY) = 3
[pid  5040] setns(201, 0)               = 0
[pid  5040] socket(AF_BLUETOOTH, SOCK_STREAM, BTPROTO_RFCOMM) = 4
[pid  5040] setns(3, 0)                 = 0
[pid  5040] close(3)                    = 0
[   78.723742][ T5036] Bluetooth: hci0: command 0x040f tx timeout
[   80.793738][ T5036] Bluetooth: hci0: command 0x0419 tx timeout
[pid  5040] connect(4, {sa_family=AF_BLUETOOTH, rc_bdaddr=ff:ff:ff:ff:ff:ff, rc_channel=8}, 10 <unfinished ...>
[pid  5034] kill(-4, SIGKILL <unfinished ...>
[pid  5040] <... connect resumed>)      = ?
[pid  5034] <... kill resumed>)         = 0
[pid  5034] kill(4, SIGKILL)            = 0
[pid  5040] +++ killed by SIGKILL +++
[pid  5034] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=4, si_uid=0, si_status=SIGKILL, si_utime=0, si_stime=0} ---
[pid  5034] restart_syscall(<... resuming interrupted kill ...>) = 0
[pid  5034] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5041 attached
, child_tidptr=0x555556ed0690) = 5
[pid  5041] set_robust_list(0x555556ed06a0, 24) = 0
[pid  5041] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5041] setpgid(0, 0)               = 0
[pid  5041] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5041] write(3, "1000", 4)         = 4
[pid  5041] close(3)                    = 0
[pid  5041] openat(AT_FDCWD, "/proc/self/ns/net", O_RDONLY) = 3
[pid  5041] setns(201, 0)               = 0
[pid  5041] socket(AF_BLUETOOTH, SOCK_STREAM, BTPROTO_RFCOMM) = 4
[pid  5041] setns(3, 0)                 = 0
[pid  5041] close(3)                    = 0
[   82.873737][ T5036] Bluetooth: hci0: command 0x0405 tx timeout
[   86.965802][  T919] cfg80211: failed to load regulatory.db
[pid  5041] connect(4, {sa_family=AF_BLUETOOTH, rc_bdaddr=ff:ff:ff:ff:ff:ff, rc_channel=8}, 10 <unfinished ...>
[pid  5034] kill(-5, SIGKILL <unfinished ...>
[pid  5041] <... connect resumed>)      = ?
[pid  5034] <... kill resumed>)         = 0
[pid  5034] kill(5, SIGKILL)            = 0
[pid  5041] +++ killed by SIGKILL +++
[pid  5034] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=5, si_uid=0, si_status=SIGKILL, si_utime=0, si_stime=0} ---
[pid  5034] restart_syscall(<... resuming interrupted kill ...>) = 0
[pid  5034] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556ed0690) = 6
./strace-static-x86_64: Process 5043 attached
[pid  5043] set_robust_list(0x555556ed06a0, 24) = 0
[pid  5043] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5043] setpgid(0, 0)               = 0
[pid  5043] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5043] write(3, "1000", 4)         = 4
[pid  5043] close(3)                    = 0
[pid  5043] openat(AT_FDCWD, "/proc/self/ns/net", O_RDONLY) = 3
[pid  5043] setns(201, 0)               = 0
[pid  5043] socket(AF_BLUETOOTH, SOCK_STREAM, BTPROTO_RFCOMM) = 4
[pid  5043] setns(3, 0)                 = 0
[pid  5043] close(3)                    = 0
[pid  5043] connect(4, {sa_family=AF_BLUETOOTH, rc_bdaddr=ff:ff:ff:ff:ff:ff, rc_channel=8}, 10 <unfinished ...>
[pid  5034] kill(-6, SIGKILL)           = 0
[pid  5043] <... connect resumed>)      = ?
[pid  5034] kill(6, SIGKILL)            = 0
[pid  5043] +++ killed by SIGKILL +++
[pid  5034] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=6, si_uid=0, si_status=SIGKILL, si_utime=0, si_stime=1 /* 0.01 s */} ---
[pid  5034] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5045 attached
, child_tidptr=0x555556ed0690) = 7
[pid  5045] set_robust_list(0x555556ed06a0, 24) = 0
[pid  5045] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5045] setpgid(0, 0)               = 0
[pid  5045] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5045] write(3, "1000", 4)         = 4
[pid  5045] close(3)                    = 0
[pid  5045] openat(AT_FDCWD, "/proc/self/ns/net", O_RDONLY) = 3
[pid  5045] setns(201, 0)               = 0
[pid  5045] socket(AF_BLUETOOTH, SOCK_STREAM, BTPROTO_RFCOMM) = 4
[pid  5045] setns(3, 0)                 = 0
[pid  5045] close(3)                    = 0
[pid  5045] connect(4, {sa_family=AF_BLUETOOTH, rc_bdaddr=ff:ff:ff:ff:ff:ff, rc_channel=8}, 10 <unfinished ...>
[pid  5034] kill(-7, SIGKILL <unfinished ...>
[pid  5045] <... connect resumed>)      = ?
[pid  5034] <... kill resumed>)         = 0
[pid  5034] kill(7, SIGKILL)            = 0
[pid  5045] +++ killed by SIGKILL +++
[pid  5034] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=7, si_uid=0, si_status=SIGKILL, si_utime=0, si_stime=0} ---
[pid  5034] restart_syscall(<... resuming interrupted kill ...>) = 0
[pid  5034] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5048 attached
, child_tidptr=0x555556ed0690) = 8
[pid  5048] set_robust_list(0x555556ed06a0, 24) = 0
[pid  5048] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5048] setpgid(0, 0)               = 0
[pid  5048] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5048] write(3, "1000", 4)         = 4
[pid  5048] close(3)                    = 0
[pid  5048] openat(AT_FDCWD, "/proc/self/ns/net", O_RDONLY) = 3
[pid  5048] setns(201, 0)               = 0
[pid  5048] socket(AF_BLUETOOTH, SOCK_STREAM, BTPROTO_RFCOMM) = 4
[pid  5048] setns(3, 0)                 = 0
[pid  5048] close(3)                    = 0
[pid  5048] connect(4, {sa_family=AF_BLUETOOTH, rc_bdaddr=ff:ff:ff:ff:ff:ff, rc_channel=8}, 10 <unfinished ...>
[pid  5034] kill(-8, SIGKILL)           = 0
[pid  5048] <... connect resumed>)      = ?
[pid  5034] kill(8, SIGKILL)            = 0
[pid  5048] +++ killed by SIGKILL +++
[pid  5034] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=8, si_uid=0, si_status=SIGKILL, si_utime=0, si_stime=0} ---
[pid  5034] restart_syscall(<... resuming interrupted kill ...>) = 0
[pid  5034] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556ed0690) = 9
./strace-static-x86_64: Process 5050 attached
[pid  5050] set_robust_list(0x555556ed06a0, 24) = 0
[pid  5050] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5050] setpgid(0, 0)               = 0
[pid  5050] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5050] write(3, "1000", 4)         = 4
[pid  5050] close(3)                    = 0
[pid  5050] openat(AT_FDCWD, "/proc/self/ns/net", O_RDONLY) = 3
[pid  5050] setns(201, 0)               = 0
[pid  5050] socket(AF_BLUETOOTH, SOCK_STREAM, BTPROTO_RFCOMM) = 4
[pid  5050] setns(3, 0)                 = 0
[pid  5050] close(3)                    = 0
[pid  5050] connect(4, {sa_family=AF_BLUETOOTH, rc_bdaddr=ff:ff:ff:ff:ff:ff, rc_channel=8}, 10 <unfinished ...>
[pid  5034] kill(-9, SIGKILL <unfinished ...>
[pid  5050] <... connect resumed>)      = ?
[pid  5034] <... kill resumed>)         = 0
[pid  5034] kill(9, SIGKILL)            = 0
[pid  5050] +++ killed by SIGKILL +++
[pid  5034] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=9, si_uid=0, si_status=SIGKILL, si_utime=0, si_stime=0} ---
[pid  5034] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5058 attached
, child_tidptr=0x555556ed0690) = 10
[pid  5058] set_robust_list(0x555556ed06a0, 24) = 0
[pid  5058] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5058] setpgid(0, 0)               = 0
[pid  5058] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5058] write(3, "1000", 4)         = 4
[pid  5058] close(3)                    = 0
[pid  5058] openat(AT_FDCWD, "/proc/self/ns/net", O_RDONLY) = 3
[pid  5058] setns(201, 0)               = 0
[pid  5058] socket(AF_BLUETOOTH, SOCK_STREAM, BTPROTO_RFCOMM) = 4
[pid  5058] setns(3, 0)                 = 0
[pid  5058] close(3)                    = 0
[pid  5058] connect(4, {sa_family=AF_BLUETOOTH, rc_bdaddr=ff:ff:ff:ff:ff:ff, rc_channel=8}, 10 <unfinished ...>
[pid  5034] kill(-10, SIGKILL <unfinished ...>
[pid  5058] <... connect resumed>)      = ?
[pid  5034] <... kill resumed>)         = 0
[pid  5034] kill(10, SIGKILL)           = 0
[pid  5058] +++ killed by SIGKILL +++
[pid  5034] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=10, si_uid=0, si_status=SIGKILL, si_utime=0, si_stime=0} ---
[pid  5034] restart_syscall(<... resuming interrupted kill ...>) = 0
[pid  5034] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5062 attached
, child_tidptr=0x555556ed0690) = 11
[pid  5062] set_robust_list(0x555556ed06a0, 24) = 0
[pid  5062] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5062] setpgid(0, 0)               = 0
[pid  5062] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5062] write(3, "1000", 4)         = 4
[pid  5062] close(3)                    = 0
[pid  5062] openat(AT_FDCWD, "/proc/self/ns/net", O_RDONLY) = 3
[pid  5062] setns(201, 0)               = 0
[pid  5062] socket(AF_BLUETOOTH, SOCK_STREAM, BTPROTO_RFCOMM) = 4
[pid  5062] setns(3, 0)                 = 0
[pid  5062] close(3)                    = 0
[pid  5062] connect(4, {sa_family=AF_BLUETOOTH, rc_bdaddr=ff:ff:ff:ff:ff:ff, rc_channel=8}, 10) = -1 ECONNREFUSED (Connection refused)
[pid  5062] openat(AT_FDCWD, "/proc/self/ns/net", O_RDONLY) = 3
[pid  5062] setns(201, 0)               = 0
[pid  5062] socket(AF_BLUETOOTH, SOCK_RAW, BTPROTO_RFCOMM) = 5
[pid  5062] setns(3, 0)                 = 0
[pid  5062] close(3)                    = 0
[pid  5062] openat(AT_FDCWD, "cgroup.kill", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 3
[pid  5062] write(3, "\x0a\xf3\x84\xab\x3c\xec\xc3\xc2\x18\x57\x15\x00\x00\x00\x00\x77\x5f\x89\x03\x17\x19\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 34136651) = 16776704
[pid  5062] mmap(0x20000000, 11755520, PROT_WRITE, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 3, 0) = 0x20000000
[pid  5062] preadv(3, 0x200015c0, 5, 0) = 16776704
[  113.579504][ T5062] 
[  113.581866][ T5062] ======================================================
[  113.588864][ T5062] WARNING: possible circular locking dependency detected
[  113.595860][ T5062] 6.6.0-rc7-syzkaller-02075-g55c900477f5b #0 Not tainted
[  113.602870][ T5062] ------------------------------------------------------
[  113.609882][ T5062] syz-executor105/5062 is trying to acquire lock:
[  113.616278][ T5062] ffffffff8e872a68 (rfcomm_mutex){+.+.}-{3:3}, at: rfcomm_dlc_exists+0x5b/0x190
[  113.625331][ T5062] 
[  113.625331][ T5062] but task is already holding lock:
[  113.632684][ T5062] ffffffff8e8779e8 (rfcomm_ioctl_mutex){+.+.}-{3:3}, at: rfcomm_dev_ioctl+0x8b9/0x1c50
[  113.642339][ T5062] 
[  113.642339][ T5062] which lock already depends on the new lock.
[  113.642339][ T5062] 
[  113.652725][ T5062] 
[  113.652725][ T5062] the existing dependency chain (in reverse order) is:
[  113.661723][ T5062] 
[  113.661723][ T5062] -> #3 (rfcomm_ioctl_mutex){+.+.}-{3:3}:
[  113.669609][ T5062]        __mutex_lock+0x181/0x1340
[  113.674720][ T5062]        rfcomm_dev_ioctl+0x8b9/0x1c50
[  113.680186][ T5062]        rfcomm_sock_ioctl+0xb0/0xe0
[  113.685469][ T5062]        sock_do_ioctl+0x113/0x270
[  113.690566][ T5062]        sock_ioctl+0x22e/0x6b0
[  113.695400][ T5062]        __x64_sys_ioctl+0x18f/0x210
[  113.700738][ T5062]        do_syscall_64+0x38/0xb0
[  113.705682][ T5062]        entry_SYSCALL_64_after_hwframe+0x63/0xcd
[  113.712096][ T5062] 
[  113.712096][ T5062] -> #2 (sk_lock-AF_BLUETOOTH-BTPROTO_RFCOMM){+.+.}-{0:0}:
[  113.721549][ T5062]        lock_sock_nested+0x3a/0xf0
[  113.726742][ T5062]        rfcomm_sk_state_change+0x6d/0x3a0
[  113.732565][ T5062]        __rfcomm_dlc_close+0x285/0x720
[  113.738117][ T5062]        rfcomm_dlc_close+0x1e7/0x240
[  113.743487][ T5062]        __rfcomm_sock_close+0xa7/0x230
[  113.749040][ T5062]        rfcomm_sock_shutdown+0xd1/0x230
[  113.754674][ T5062]        rfcomm_sock_release+0x5d/0x140
[  113.760228][ T5062]        __sock_release+0xae/0x260
[  113.765333][ T5062]        sock_close+0x1c/0x20
[  113.770003][ T5062]        __fput+0x3f7/0xa70
[  113.774503][ T5062]        task_work_run+0x14d/0x240
[  113.779613][ T5062]        do_exit+0xa92/0x2a20
[  113.784292][ T5062]        do_group_exit+0xd4/0x2a0
[  113.789326][ T5062]        get_signal+0x23ba/0x2790
[  113.794342][ T5062]        arch_do_signal_or_restart+0x90/0x7f0
[  113.800409][ T5062]        exit_to_user_mode_prepare+0x11f/0x240
[  113.806555][ T5062]        syscall_exit_to_user_mode+0x1d/0x60
[  113.812531][ T5062]        do_syscall_64+0x44/0xb0
[  113.817463][ T5062]        entry_SYSCALL_64_after_hwframe+0x63/0xcd
[  113.823918][ T5062] 
[  113.823918][ T5062] -> #1 (&d->lock){+.+.}-{3:3}:
[  113.830952][ T5062]        __mutex_lock+0x181/0x1340
[  113.836059][ T5062]        __rfcomm_dlc_close+0x231/0x720
[  113.841604][ T5062]        rfcomm_dlc_close+0x1e7/0x240
[  113.846978][ T5062]        __rfcomm_sock_close+0xa7/0x230
[  113.852536][ T5062]        rfcomm_sock_shutdown+0xd1/0x230
[  113.858189][ T5062]        rfcomm_sock_release+0x5d/0x140
[  113.863748][ T5062]        __sock_release+0xae/0x260
[  113.868855][ T5062]        sock_close+0x1c/0x20
[  113.873526][ T5062]        __fput+0x3f7/0xa70
[  113.878031][ T5062]        task_work_run+0x14d/0x240
[  113.883150][ T5062]        do_exit+0xa92/0x2a20
[  113.887831][ T5062]        do_group_exit+0xd4/0x2a0
[  113.892859][ T5062]        get_signal+0x23ba/0x2790
[  113.897874][ T5062]        arch_do_signal_or_restart+0x90/0x7f0
[  113.903938][ T5062]        exit_to_user_mode_prepare+0x11f/0x240
[  113.910092][ T5062]        syscall_exit_to_user_mode+0x1d/0x60
[  113.916067][ T5062]        do_syscall_64+0x44/0xb0
[  113.920994][ T5062]        entry_SYSCALL_64_after_hwframe+0x63/0xcd
[  113.927402][ T5062] 
[  113.927402][ T5062] -> #0 (rfcomm_mutex){+.+.}-{3:3}:
[  113.934777][ T5062]        __lock_acquire+0x2e3d/0x5de0
[  113.940149][ T5062]        lock_acquire+0x1ae/0x510
[  113.945174][ T5062]        __mutex_lock+0x181/0x1340
[  113.950282][ T5062]        rfcomm_dlc_exists+0x5b/0x190
[  113.955655][ T5062]        rfcomm_dev_ioctl+0x999/0x1c50
[  113.961104][ T5062]        rfcomm_sock_ioctl+0xb0/0xe0
[  113.966385][ T5062]        sock_do_ioctl+0x113/0x270
[  113.971488][ T5062]        sock_ioctl+0x22e/0x6b0
[  113.976330][ T5062]        __x64_sys_ioctl+0x18f/0x210
[  113.981606][ T5062]        do_syscall_64+0x38/0xb0
[  113.986563][ T5062]        entry_SYSCALL_64_after_hwframe+0x63/0xcd
[  113.992969][ T5062] 
[  113.992969][ T5062] other info that might help us debug this:
[  113.992969][ T5062] 
[  114.003181][ T5062] Chain exists of:
[  114.003181][ T5062]   rfcomm_mutex --> sk_lock-AF_BLUETOOTH-BTPROTO_RFCOMM --> rfcomm_ioctl_mutex
[  114.003181][ T5062] 
[  114.017946][ T5062]  Possible unsafe locking scenario:
[  114.017946][ T5062] 
[  114.025379][ T5062]        CPU0                    CPU1
[  114.030732][ T5062]        ----                    ----
[  114.036081][ T5062]   lock(rfcomm_ioctl_mutex);
[  114.040746][ T5062]                                lock(sk_lock-AF_BLUETOOTH-BTPROTO_RFCOMM);
[  114.049425][ T5062]                                lock(rfcomm_ioctl_mutex);
[  114.056609][ T5062]   lock(rfcomm_mutex);
[  114.060757][ T5062] 
[  114.060757][ T5062]  *** DEADLOCK ***
[  114.060757][ T5062] 
[  114.068884][ T5062] 2 locks held by syz-executor105/5062:
[  114.074415][ T5062]  #0: ffff88802568a130 (sk_lock-AF_BLUETOOTH-BTPROTO_RFCOMM){+.+.}-{0:0}, at: rfcomm_sock_ioctl+0xa3/0xe0
[  114.085813][ T5062]  #1: ffffffff8e8779e8 (rfcomm_ioctl_mutex){+.+.}-{3:3}, at: rfcomm_dev_ioctl+0x8b9/0x1c50
[  114.095897][ T5062] 
[  114.095897][ T5062] stack backtrace:
[  114.101770][ T5062] CPU: 0 PID: 5062 Comm: syz-executor105 Not tainted 6.6.0-rc7-syzkaller-02075-g55c900477f5b #0
[  114.112173][ T5062] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/09/2023
[  114.122216][ T5062] Call Trace:
[  114.125489][ T5062]  <TASK>
[  114.128411][ T5062]  dump_stack_lvl+0xd9/0x1b0
[  114.133008][ T5062]  check_noncircular+0x311/0x3f0
[  114.137945][ T5062]  ? print_circular_bug+0x750/0x750
[  114.143139][ T5062]  ? is_bpf_text_address+0x94/0x1a0
[  114.148329][ T5062]  ? kernel_text_address+0x85/0xf0
[  114.153443][ T5062]  ? arch_stack_walk+0x112/0x170
[  114.158376][ T5062]  __lock_acquire+0x2e3d/0x5de0
[  114.163230][ T5062]  ? lockdep_hardirqs_on_prepare+0x410/0x410
[  114.169208][ T5062]  ? save_trace+0x4e/0xb30
[  114.173629][ T5062]  ? _find_first_zero_bit+0x94/0xb0
[  114.178823][ T5062]  ? add_lock_to_list+0x17d/0x380
[  114.183845][ T5062]  lock_acquire+0x1ae/0x510
[  114.188347][ T5062]  ? rfcomm_dlc_exists+0x5b/0x190
[  114.193375][ T5062]  ? lock_sync+0x190/0x190
[  114.197793][ T5062]  ? lockdep_hardirqs_on_prepare+0x410/0x410
[  114.203771][ T5062]  ? preempt_count_sub+0x150/0x150
[  114.208887][ T5062]  __mutex_lock+0x181/0x1340
[  114.213475][ T5062]  ? rfcomm_dlc_exists+0x5b/0x190
[  114.218588][ T5062]  ? rfcomm_dlc_exists+0x5b/0x190
[  114.223627][ T5062]  ? find_held_lock+0x2d/0x110
[  114.228390][ T5062]  ? mutex_lock_io_nested+0x11a0/0x11a0
[  114.233930][ T5062]  ? __might_fault+0x13f/0x1a0
[  114.238689][ T5062]  ? reacquire_held_locks+0x4b0/0x4b0
[  114.244060][ T5062]  ? preempt_count_sub+0x150/0x150
[  114.249173][ T5062]  ? apparmor_capable+0x1da/0x4e0
[  114.254194][ T5062]  ? rfcomm_dlc_exists+0x5b/0x190
[  114.259221][ T5062]  rfcomm_dlc_exists+0x5b/0x190
[  114.264071][ T5062]  rfcomm_dev_ioctl+0x999/0x1c50
[  114.269007][ T5062]  ? rfcomm_dev_state_change+0x170/0x170
[  114.274632][ T5062]  ? reacquire_held_locks+0x4b0/0x4b0
[  114.280003][ T5062]  ? mark_held_locks+0x9f/0xe0
[  114.284766][ T5062]  ? __local_bh_enable_ip+0xa4/0x120
[  114.290044][ T5062]  rfcomm_sock_ioctl+0xb0/0xe0
[  114.294809][ T5062]  sock_do_ioctl+0x113/0x270
[  114.299397][ T5062]  ? get_user_ifreq+0x250/0x250
[  114.304246][ T5062]  ? do_vfs_ioctl+0x379/0x1920
[  114.309005][ T5062]  ? vfs_fileattr_set+0xbf0/0xbf0
[  114.314027][ T5062]  sock_ioctl+0x22e/0x6b0
[  114.318354][ T5062]  ? br_ioctl_call+0xb0/0xb0
[  114.322942][ T5062]  ? bpf_lsm_file_ioctl+0x9/0x10
[  114.327876][ T5062]  ? br_ioctl_call+0xb0/0xb0
[  114.332462][ T5062]  __x64_sys_ioctl+0x18f/0x210
[  114.337225][ T5062]  do_syscall_64+0x38/0xb0
[  114.341637][ T5062]  entry_SYSCALL_64_after_hwframe+0x63/0xcd
[  114.347525][ T5062] RIP: 0033:0x7fd4b8c8fd89
[  114.351929][ T5062] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 11 19 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48
[  114.371528][ T5062] RSP: 002b:00007ffd308aaf08 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[pid  5062] ioctl(5, RFCOMMCREATEDEV, 0x20000100) = 0
[pid  5062] close(3)                    = 0
[pid  5062] close(4)                    = 0
[pid  5062] close(5)                    = 0
[pid  5062] close(6)                    = -1 EBADF (Bad file descriptor)
[pid  5062] close(7)                    = -1 EBADF (Bad file descriptor)
[pid  5062] close(8)                    = -1 EBADF (Bad file descriptor)
[pid  5062] close(9)                    = -1 EBADF (Bad file descriptor)
[pid  5062] close(10)                   = -1 EBADF (Bad file descriptor)
[pid  5062] close(11)                   = -1 EBADF (Bad file descriptor)
[pid  5062] close(12)                   = -1 EBADF (Bad file descriptor)
[pid  5062] close(13)                   = -1 EBADF (Bad file descriptor)
[pid  5062] close(14)                   = -1 EBADF (Bad file descriptor)
[pid  5062] close(15)                   = -1 EBADF (Bad file descriptor)
[pid  5062] close(16)                   = -1 EBADF (Bad file descriptor)
[pid  5062] close(17)                   = -1 EBADF (Bad file descriptor)
[pid  5062] close(18)                   = -1 EBADF (Bad file descriptor)
[pid  5062] close(19)                   = -1 EBADF (Bad file descriptor)
[pid  5062] close(20)                   = -1 EBADF (Bad file descriptor)
[pid  5062] close(21)                   = -1 EBADF (Bad file descriptor)
[pid  5062] close(22)                   = -1 EBADF (Bad file descriptor)
[pid  5062] close(23)                   = -1 EBADF (Bad file descriptor)
[pid  5062] close(24)                   = -1 EBADF (Bad file descriptor)
[pid  5062] close(25)                   = -1 EBADF (Bad file descriptor)
[pid  5062] close(26)                   = -1 EBADF (Bad file descriptor)
[pid  5062] close(27)                   = -1 EBADF (Bad file descriptor)
[pid  5062] close(28)                   = -1 EBADF (Bad file descriptor)
[pid  5062] close(29)                   = -1 EBADF (Bad file descriptor)
[pid  5062] exit_group(0)               = ?
[pid  5062] +++ exited with 0 +++
[pid  5034] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=11, si_uid=0, si_status=0, si_utime=0, si_stime=42 /* 0.42 s */} ---
[pid  5034] restart_syscall(<... resuming interrupted clone ...>) = 0
[pid  5034] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556ed0690) = 12
./strace-static-x86_64: Process 5063 attached
[  114.379932][ T5062] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fd4b8c8fd89
[  114.387895][ T5062] RDX: 0000000020000100 RSI: 00000000400452c8 RDI: 0000000000000005
[  114.395858][ T5062] RBP: 00000000000f4240 R08: 0000000000000000 R09: 0000000000000000
[  114.403818][ T5062] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffd308aaf60
[  114.411778][ T5062] R13: 00007ffd308aaf70 R14: 000000000001a46a R15: 00007ffd308aaf30
[  114.419746][ T5062]  </TASK>
[pid  5063] set_robust_list(0x555556ed06a0, 24) = 0
[pid  5063] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5063] setpgid(0, 0)               = 0
[pid  5063] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5063] write(3, "1000", 4)         = 4
[pid  5063] close(3)                    = 0
[pid  5063] openat(AT_FDCWD, "/proc/self/ns/net", O_RDONLY) = 3
[pid  5063] setns(201, 0)               = 0
[pid  5063] socket(AF_BLUETOOTH, SOCK_STREAM, BTPROTO_RFCOMM) = 4
[pid  5063] setns(3, 0)                 = 0
[pid  5063] close(3)                    = 0
[  116.473698][ T4440] Bluetooth: hci0: command 0x0405 tx timeout
[pid  5063] connect(4, {sa_family=AF_BLUETOOTH, rc_bdaddr=ff:ff:ff:ff:ff:ff, rc_channel=8}, 10 <unfinished ...>
[pid  5034] kill(-12, SIGKILL <unfinished ...>
[pid  5063] <... connect resumed>)      = ?
[pid  5034] <... kill resumed>)         = 0
[pid  5034] kill(12, SIGKILL)           = 0
[pid  5063] +++ killed by SIGKILL +++
[pid  5034] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=12, si_uid=0, si_status=SIGKILL, si_utime=0, si_stime=1 /* 0.01 s */} ---
[pid  5034] restart_syscall(<... resuming interrupted kill ...>) = 0
[pid  5034] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556ed0690) = 13
./strace-static-x86_64: Process 5065 attached
[pid  5065] set_robust_list(0x555556ed06a0, 24) = 0
[pid  5065] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5065] setpgid(0, 0)               = 0
[pid  5065] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5065] write(3, "1000", 4)         = 4
[pid  5065] close(3)                    = 0
[pid  5065] openat(AT_FDCWD, "/proc/self/ns/net", O_RDONLY) = 3
[pid  5065] setns(201, 0)               = 0
[pid  5065] socket(AF_BLUETOOTH, SOCK_STREAM, BTPROTO_RFCOMM) = 4
[pid  5065] setns(3, 0)                 = 0
[pid  5065] close(3)                    = 0