./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor239602413 <...> Warning: Permanently added '10.128.0.226' (ED25519) to the list of known hosts. execve("./syz-executor239602413", ["./syz-executor239602413"], 0x7ffe314029a0 /* 10 vars */) = 0 brk(NULL) = 0x55558c90e000 brk(0x55558c90ed40) = 0x55558c90ed40 arch_prctl(ARCH_SET_FS, 0x55558c90e3c0) = 0 set_tid_address(0x55558c90e690) = 5229 set_robust_list(0x55558c90e6a0, 24) = 0 rseq(0x55558c90ece0, 0x20, 0, 0x53053053) = 0 prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 readlink("/proc/self/exe", "/root/syz-executor239602413", 4096) = 27 getrandom("\xec\x3a\x6c\x93\xa7\x24\xef\xe3", 8, GRND_NONBLOCK) = 8 brk(NULL) = 0x55558c90ed40 brk(0x55558c92fd40) = 0x55558c92fd40 brk(0x55558c930000) = 0x55558c930000 mprotect(0x7fcbc71f0000, 16384, PROT_READ) = 0 mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000 mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000 mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5230 attached [pid 5230] set_robust_list(0x55558c90e6a0, 24 [pid 5229] <... clone resumed>, child_tidptr=0x55558c90e690) = 5230 [pid 5230] <... set_robust_list resumed>) = 0 [pid 5229] openat(AT_FDCWD, "/sys/kernel/debug/x86/nmi_longest_ns", O_WRONLY|O_CLOEXEC) = 3 [pid 5229] write(3, "10000000000", 11) = 11 [pid 5229] close(3) = 0 [pid 5229] openat(AT_FDCWD, "/proc/sys/kernel/hung_task_check_interval_secs", O_WRONLY|O_CLOEXEC) = 3 [pid 5229] write(3, "20", 2) = 2 [pid 5229] close(3) = 0 [pid 5229] openat(AT_FDCWD, "/proc/sys/net/core/bpf_jit_kallsyms", O_WRONLY|O_CLOEXEC) = 3 [pid 5229] write(3, "1", 1) = 1 [pid 5229] close(3) = 0 [pid 5229] openat(AT_FDCWD, "/proc/sys/net/core/bpf_jit_harden", O_WRONLY|O_CLOEXEC) = 3 [pid 5229] write(3, "0", 1) = 1 [pid 5229] close(3) = 0 [pid 5229] openat(AT_FDCWD, "/proc/sys/kernel/kptr_restrict", O_WRONLY|O_CLOEXEC) = 3 [pid 5229] write(3, "0", 1) = 1 [pid 5229] close(3) = 0 [pid 5229] openat(AT_FDCWD, "/proc/sys/kernel/softlockup_all_cpu_backtrace", O_WRONLY|O_CLOEXEC) = 3 [pid 5229] write(3, "1", 1) = 1 [pid 5229] close(3) = 0 [pid 5229] openat(AT_FDCWD, "/proc/sys/fs/mount-max", O_WRONLY|O_CLOEXEC) = 3 [pid 5229] write(3, "100", 3) = 3 [pid 5229] close(3) = 0 [pid 5229] openat(AT_FDCWD, "/proc/sys/vm/oom_dump_tasks", O_WRONLY|O_CLOEXEC) = 3 [pid 5229] write(3, "0", 1) = 1 [pid 5229] close(3) = 0 [pid 5229] openat(AT_FDCWD, "/proc/sys/debug/exception-trace", O_WRONLY|O_CLOEXEC) = 3 [pid 5229] write(3, "0", 1) = 1 [pid 5229] close(3) = 0 [pid 5229] openat(AT_FDCWD, "/proc/sys/kernel/printk", O_WRONLY|O_CLOEXEC) = 3 [pid 5229] write(3, "7 4 1 3", 7) = 7 [pid 5229] close(3) = 0 [pid 5229] openat(AT_FDCWD, "/proc/sys/kernel/keys/gc_delay", O_WRONLY|O_CLOEXEC) = 3 [pid 5229] write(3, "1", 1) = 1 [pid 5229] close(3) = 0 [pid 5229] openat(AT_FDCWD, "/proc/sys/vm/oom_kill_allocating_task", O_WRONLY|O_CLOEXEC) = 3 [pid 5229] write(3, "1", 1) = 1 [pid 5229] close(3) = 0 [pid 5229] openat(AT_FDCWD, "/proc/sys/kernel/ctrl-alt-del", O_WRONLY|O_CLOEXEC) = 3 [pid 5229] write(3, "0", 1) = 1 [pid 5229] close(3) = 0 [pid 5229] openat(AT_FDCWD, "/proc/sys/kernel/cad_pid", O_WRONLY|O_CLOEXEC) = 3 [pid 5229] write(3, "5230", 4) = 4 [pid 5229] close(3) = 0 [pid 5229] kill(5230, SIGKILL) = 0 [pid 5230] +++ killed by SIGKILL +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=5230, si_uid=0, si_status=SIGKILL, si_utime=0, si_stime=0} --- mount(NULL, "/proc/sys/fs/binfmt_misc", "binfmt_misc", 0, NULL) = -1 EBUSY (Device or resource busy) unshare(CLONE_NEWPID) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55558c90e690) = 5231 ./strace-static-x86_64: Process 5231 attached [pid 5231] set_robust_list(0x55558c90e6a0, 24) = 0 [pid 5231] mount(NULL, "/sys/fs/fuse/connections", "fusectl", 0, NULL) = -1 EBUSY (Device or resource busy) [pid 5231] socket(AF_BLUETOOTH, SOCK_RAW, BTPROTO_HCI) = 3 [pid 5231] openat(AT_FDCWD, "/dev/vhci", O_RDWR) = 4 [pid 5231] dup2(4, 202) = 202 [pid 5231] close(4) = 0 [pid 5231] write(202, "\xff\x00", 2) = 2 [pid 5231] read(202, "\xff\x00\x00\x00", 4) = 4 [pid 5231] rt_sigaction(SIGRT_1, {sa_handler=0x7fcbc7199a00, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7fcbc718b810}, NULL, 8) = 0 [pid 5231] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 5231] mmap(NULL, 8392704, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7fcbc6800000 [pid 5231] mprotect(0x7fcbc6801000, 8388608, PROT_READ|PROT_WRITE) = 0 [pid 5231] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5231] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7fcbc7000990, parent_tid=0x7fcbc7000990, exit_signal=0, stack=0x7fcbc6800000, stack_size=0x800300, tls=0x7fcbc70006c0}./strace-static-x86_64: Process 5235 attached => {parent_tid=[2]}, 88) = 2 [pid 5235] rseq(0x7fcbc7000fe0, 0x20, 0, 0x53053053 [pid 5231] rt_sigprocmask(SIG_SETMASK, [], [pid 5235] <... rseq resumed>) = 0 [pid 5235] set_robust_list(0x7fcbc70009a0, 24 [pid 5231] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5235] <... set_robust_list resumed>) = 0 [pid 5231] ioctl(3, HCIDEVUP [pid 5235] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5235] read(202, "\x01\x03\x0c\x00", 1024) = 4 [pid 5235] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x0e\xfc", iov_len=2}, {iov_base="\x01\x03\x0c", iov_len=3}, {iov_base="\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., iov_len=249}], 4) = 255 [pid 5235] read(202, "\x01\x03\x10\x00", 1024) = 4 [pid 5235] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x0e\xfc", iov_len=2}, {iov_base="\x01\x03\x10", iov_len=3}, {iov_base="\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., iov_len=249}], 4) = 255 [pid 5235] read(202, "\x01\x01\x10\x00", 1024) = 4 [pid 5235] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x0e\xfc", iov_len=2}, {iov_base="\x01\x01\x10", iov_len=3}, {iov_base="\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., iov_len=249}], 4) = 255 [pid 5235] read(202, "\x01\x09\x10\x00", 1024) = 4 [pid 5235] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x0e\x0a", iov_len=2}, {iov_base="\x01\x09\x10", iov_len=3}, {iov_base="\x00\xaa\xaa\xaa\xaa\xaa\xaa", iov_len=7}], 4) = 13 [pid 5235] read(202, "\x01\x05\x10\x00", 1024) = 4 [pid 5235] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x0e\x0b", iov_len=2}, {iov_base="\x01\x05\x10", iov_len=3}, {iov_base="\x00\xfd\x03\x60\x04\x00\x06\x00", iov_len=8}], 4) = 14 [pid 5235] read(202, "\x01\x23\x0c\x00", 1024) = 4 [pid 5235] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x0e\xfc", iov_len=2}, {iov_base="\x01\x23\x0c", iov_len=3}, {iov_base="\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., iov_len=249}], 4) = 255 [pid 5235] read(202, "\x01\x14\x0c\x00", 1024) = 4 [pid 5235] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x0e\xfc", iov_len=2}, {iov_base="\x01\x14\x0c", iov_len=3}, {iov_base="\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., iov_len=249}], 4) = 255 [pid 5235] read(202, "\x01\x25\x0c\x00", 1024) = 4 [pid 5235] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x0e\xfc", iov_len=2}, {iov_base="\x01\x25\x0c", iov_len=3}, {iov_base="\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., iov_len=249}], 4) = 255 [ 58.002220][ T54] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 58.020557][ T54] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 58.032066][ T54] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 58.043238][ T54] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [pid 5235] read(202, "\x01\x38\x0c\x00", 1024) = 4 [pid 5235] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x0e\xfc", iov_len=2}, {iov_base="\x01\x38\x0c", iov_len=3}, {iov_base="\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., iov_len=249}], 4) = 255 [pid 5235] read(202, "\x01\x39\x0c\x00", 1024) = 4 [pid 5235] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x0e\xfc", iov_len=2}, {iov_base="\x01\x39\x0c", iov_len=3}, {iov_base="\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., iov_len=249}], 4) = 255 [pid 5235] read(202, "\x01\x16\x0c\x02\x00\x7d", 1024) = 6 [pid 5235] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x0e\xfc", iov_len=2}, {iov_base="\x01\x16\x0c", iov_len=3}, {iov_base="\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., iov_len=249}], 4) = 255 [pid 5235] read(202, [pid 5231] <... ioctl resumed>, 0) = -1 EALREADY (Operation already in progress) [pid 5231] ioctl(3, HCISETSCAN [pid 5235] <... read resumed>"\x01\x1a\x0c\x01\x02", 1024) = 5 [pid 5235] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x0e\x04", iov_len=2}, {iov_base="\x01\x1a\x0c", iov_len=3}, {iov_base="\x00", iov_len=1}], 4) = 7 [pid 5231] <... ioctl resumed>, 0x7ffd7cc7c850) = 0 [pid 5235] rt_sigprocmask(SIG_BLOCK, ~[RT_1], [pid 5231] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x04\x0a", iov_len=2}, {iov_base="\xaa\xaa\xaa\xaa\xaa\x10\x00\x00\x00\x01", iov_len=10}], 3) = 13 [pid 5231] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x03\x0b", iov_len=2}, {iov_base="\x00\xc8\x00\xaa\xaa\xaa\xaa\xaa\x10\x01\x00", iov_len=11}], 3) = 14 [ 58.072607][ T54] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 58.090956][ T54] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [pid 5231] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\v\v", iov_len=2}, {iov_base="\x00\xc8\x00\x00\x00\x00\x00\x00\x00\x00\x00", iov_len=11}], 3) = 14 [pid 5235] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5235] madvise(0x7fcbc6800000, 8372224, MADV_DONTNEED [pid 5231] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x3e\x13", iov_len=2}, {iov_base="\x01\x00\xc9\x00\x01\x00\xaa\xaa\xaa\xaa\xaa\x11\x00\x00\x00\x00\x00\x00\x00", iov_len=19}], 3 [pid 5235] <... madvise resumed>) = 0 [pid 5231] <... writev resumed>) = 22 [pid 5231] futex(0x7fcbc7000990, FUTEX_WAIT_BITSET|FUTEX_CLOCK_REALTIME, 2, NULL, FUTEX_BITSET_MATCH_ANY [pid 5235] exit(0) = ? [pid 5235] +++ exited with 0 +++ [pid 5231] <... futex resumed>) = 0 [pid 5231] close(3) = 0 [pid 5231] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5231] setsid() = 1 [pid 5231] openat(AT_FDCWD, "/proc/self/ns/net", O_RDONLY) = 3 [pid 5231] dup2(3, 201) = 201 [pid 5231] close(3) = 0 [pid 5231] prlimit64(0, RLIMIT_AS, {rlim_cur=204800*1024, rlim_max=204800*1024}, NULL) = 0 [pid 5231] prlimit64(0, RLIMIT_MEMLOCK, {rlim_cur=32768*1024, rlim_max=32768*1024}, NULL) = 0 [pid 5231] prlimit64(0, RLIMIT_FSIZE, {rlim_cur=139264*1024, rlim_max=139264*1024}, NULL) = 0 [pid 5231] prlimit64(0, RLIMIT_STACK, {rlim_cur=1024*1024, rlim_max=1024*1024}, NULL) = 0 [pid 5231] prlimit64(0, RLIMIT_CORE, {rlim_cur=131072*1024, rlim_max=131072*1024}, NULL) = 0 [pid 5231] prlimit64(0, RLIMIT_NOFILE, {rlim_cur=256, rlim_max=256}, NULL) = 0 [pid 5231] unshare(CLONE_NEWNS) = 0 [pid 5231] mount(NULL, "/", NULL, MS_REC|MS_PRIVATE, NULL) = 0 [pid 5231] unshare(CLONE_NEWIPC) = 0 [pid 5231] unshare(CLONE_NEWCGROUP) = 0 [pid 5231] unshare(CLONE_NEWUTS) = 0 [pid 5231] unshare(CLONE_SYSVSEM) = 0 [pid 5231] openat(AT_FDCWD, "/proc/sys/kernel/shmmax", O_WRONLY|O_CLOEXEC) = 3 [pid 5231] write(3, "16777216", 8) = 8 [pid 5231] close(3) = 0 [pid 5231] openat(AT_FDCWD, "/proc/sys/kernel/shmall", O_WRONLY|O_CLOEXEC) = 3 [pid 5231] write(3, "536870912", 9) = 9 [pid 5231] close(3) = 0 [pid 5231] openat(AT_FDCWD, "/proc/sys/kernel/shmmni", O_WRONLY|O_CLOEXEC) = 3 [pid 5231] write(3, "1024", 4) = 4 [pid 5231] close(3) = 0 [pid 5231] openat(AT_FDCWD, "/proc/sys/kernel/msgmax", O_WRONLY|O_CLOEXEC) = 3 [pid 5231] write(3, "8192", 4) = 4 [pid 5231] close(3) = 0 [pid 5231] openat(AT_FDCWD, "/proc/sys/kernel/msgmni", O_WRONLY|O_CLOEXEC) = 3 [pid 5231] write(3, "1024", 4) = 4 [pid 5231] close(3) = 0 [pid 5231] openat(AT_FDCWD, "/proc/sys/kernel/msgmnb", O_WRONLY|O_CLOEXEC) = 3 [pid 5231] write(3, "1024", 4) = 4 [pid 5231] close(3) = 0 [pid 5231] openat(AT_FDCWD, "/proc/sys/kernel/sem", O_WRONLY|O_CLOEXEC) = 3 [pid 5231] write(3, "1024 1048576 500 1024", 21) = 21 [pid 5231] close(3) = 0 [pid 5231] getpid() = 1 [pid 5231] capget({version=_LINUX_CAPABILITY_VERSION_3, pid=1}, {effective=1< [pid 5244] set_robust_list(0x55558c90e6a0, 24 [pid 5231] <... clone resumed>, child_tidptr=0x55558c90e690) = 3 [pid 5244] <... set_robust_list resumed>) = 0 [pid 5244] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5244] setpgid(0, 0) = 0 [pid 5244] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5244] write(3, "1000", 4) = 4 [pid 5244] close(3) = 0 [pid 5244] write(1, "executing program\n", 18executing program ) = 18 [pid 5244] futex(0x7fcbc71f640c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5244] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7fcbc7100000 [pid 5244] mprotect(0x7fcbc7101000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5244] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5244] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7fcbc7120990, parent_tid=0x7fcbc7120990, exit_signal=0, stack=0x7fcbc7100000, stack_size=0x20300, tls=0x7fcbc71206c0}./strace-static-x86_64: Process 5245 attached [pid 5245] rseq(0x7fcbc7120fe0, 0x20, 0, 0x53053053 [pid 5244] <... clone3 resumed> => {parent_tid=[4]}, 88) = 4 [pid 5245] <... rseq resumed>) = 0 [pid 5245] set_robust_list(0x7fcbc71209a0, 24) = 0 [pid 5245] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5245] futex(0x7fcbc71f6408, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5244] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5244] futex(0x7fcbc71f6408, FUTEX_WAKE_PRIVATE, 1000000 [pid 5245] <... futex resumed>) = 0 [pid 5244] <... futex resumed>) = 1 [pid 5244] futex(0x7fcbc71f640c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5245] openat(AT_FDCWD, "/proc/self/ns/net", O_RDONLY) = 3 [pid 5245] setns(201, 0) = 0 [pid 5245] socket(AF_BLUETOOTH, SOCK_RAW, BTPROTO_HCI) = 4 [pid 5245] setns(3, 0) = 0 [pid 5245] close(3) = 0 [pid 5245] futex(0x7fcbc71f640c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5244] <... futex resumed>) = 0 [pid 5245] futex(0x7fcbc71f6408, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5244] futex(0x7fcbc71f6408, FUTEX_WAKE_PRIVATE, 1000000 [pid 5245] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5244] <... futex resumed>) = 0 [pid 5245] ioctl(4, HCIINQUIRY [pid 5244] futex(0x7fcbc71f640c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}) = -1 ETIMEDOUT (Connection timed out) [pid 5244] futex(0x7fcbc71f640c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=0}) = -1 ETIMEDOUT (Connection timed out) [pid 5244] futex(0x7fcbc71f641c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5244] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7fcbc70df000 [pid 5244] mprotect(0x7fcbc70e0000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5244] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5244] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7fcbc70ff990, parent_tid=0x7fcbc70ff990, exit_signal=0, stack=0x7fcbc70df000, stack_size=0x20300, tls=0x7fcbc70ff6c0}./strace-static-x86_64: Process 5246 attached [pid 5246] rseq(0x7fcbc70fffe0, 0x20, 0, 0x53053053) = 0 [pid 5246] set_robust_list(0x7fcbc70ff9a0, 24) = 0 [pid 5244] <... clone3 resumed> => {parent_tid=[5]}, 88) = 5 [pid 5246] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5246] futex(0x7fcbc71f6418, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5244] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5244] futex(0x7fcbc71f6418, FUTEX_WAKE_PRIVATE, 1000000 [pid 5246] <... futex resumed>) = 0 [pid 5244] <... futex resumed>) = 1 [pid 5246] openat(AT_FDCWD, "/proc/self/ns/net", O_RDONLY [pid 5244] futex(0x7fcbc71f641c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5246] <... openat resumed>) = 3 [pid 5246] setns(201, 0) = 0 [pid 5246] socket(AF_BLUETOOTH, SOCK_RAW, BTPROTO_HCI) = 5 [pid 5246] setns(3, 0) = 0 [pid 5246] close(3) = 0 [pid 5246] futex(0x7fcbc71f641c, FUTEX_WAKE_PRIVATE, 1000000 [pid 5244] <... futex resumed>) = 0 [pid 5244] futex(0x7fcbc71f6418, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5244] futex(0x7fcbc71f641c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5246] <... futex resumed>) = 1 [pid 5246] unshare(CLONE_FILES|CLONE_NEWUTS) = 0 [pid 5246] futex(0x7fcbc71f641c, FUTEX_WAKE_PRIVATE, 1000000 [pid 5244] <... futex resumed>) = 0 [pid 5246] <... futex resumed>) = 1 [pid 5244] futex(0x7fcbc71f6418, FUTEX_WAKE_PRIVATE, 1000000 [pid 5246] socket(AF_UNIX, SOCK_RAW|SOCK_NONBLOCK, 0 [pid 5244] <... futex resumed>) = 0 [pid 5246] <... socket resumed>) = 3 [pid 5244] futex(0x7fcbc71f641c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5246] futex(0x7fcbc71f641c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5244] <... futex resumed>) = 0 [pid 5246] futex(0x7fcbc71f6418, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5244] futex(0x7fcbc71f6418, FUTEX_WAKE_PRIVATE, 1000000 [pid 5246] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5244] <... futex resumed>) = 0 [pid 5246] socket(AF_INET, SOCK_DGRAM, IPPROTO_IP [pid 5244] futex(0x7fcbc71f641c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5246] <... socket resumed>) = 6 [pid 5246] futex(0x7fcbc71f641c, FUTEX_WAKE_PRIVATE, 1000000 [pid 5244] <... futex resumed>) = 0 [pid 5246] <... futex resumed>) = 1 [pid 5244] futex(0x7fcbc71f6418, FUTEX_WAKE_PRIVATE, 1000000 [pid 5246] openat(AT_FDCWD, "/proc/self/ns/net", O_RDONLY [pid 5244] <... futex resumed>) = 0 [pid 5246] <... openat resumed>) = 7 [pid 5244] futex(0x7fcbc71f641c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5246] setns(201, 0) = 0 [pid 5246] socket(AF_BLUETOOTH, SOCK_RAW, BTPROTO_HCI) = 8 [pid 5246] setns(7, 0) = 0 [pid 5246] close(7) = 0 [pid 5246] futex(0x7fcbc71f641c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5244] <... futex resumed>) = 0 [pid 5246] ioctl(8, HCIDEVDOWN [pid 5244] futex(0x7fcbc71f6418, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5244] futex(0x7fcbc71f641c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}) = -1 ETIMEDOUT (Connection timed out) [pid 5244] futex(0x7fcbc71f641c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=0}) = -1 ETIMEDOUT (Connection timed out) [pid 5244] futex(0x7fcbc71f642c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5244] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7fcbc70be000 [pid 5244] mprotect(0x7fcbc70bf000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5244] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5244] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7fcbc70de990, parent_tid=0x7fcbc70de990, exit_signal=0, stack=0x7fcbc70be000, stack_size=0x20300, tls=0x7fcbc70de6c0}./strace-static-x86_64: Process 5247 attached [pid 5247] rseq(0x7fcbc70defe0, 0x20, 0, 0x53053053) = 0 [pid 5247] set_robust_list(0x7fcbc70de9a0, 24) = 0 [pid 5244] <... clone3 resumed> => {parent_tid=[6]}, 88) = 6 [pid 5247] rt_sigprocmask(SIG_SETMASK, [], [pid 5244] rt_sigprocmask(SIG_SETMASK, [], [pid 5247] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5247] futex(0x7fcbc71f6428, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5244] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5244] futex(0x7fcbc71f6428, FUTEX_WAKE_PRIVATE, 1000000 [pid 5247] <... futex resumed>) = 0 [pid 5244] <... futex resumed>) = 1 [pid 5247] openat(AT_FDCWD, "/proc/self/ns/net", O_RDONLY [pid 5244] futex(0x7fcbc71f642c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5247] <... openat resumed>) = 3 [pid 5247] setns(201, 0) = 0 [pid 5247] socket(AF_NFC, SOCK_STREAM, NFC_SOCKPROTO_LLCP) = 6 [pid 5247] setns(3, 0) = 0 [pid 5247] close(3) = 0 [pid 5247] futex(0x7fcbc71f642c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5244] <... futex resumed>) = 0 [pid 5247] futex(0x7fcbc71f6428, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5244] futex(0x7fcbc71f6428, FUTEX_WAKE_PRIVATE, 1000000 [pid 5247] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5244] <... futex resumed>) = 0 [pid 5247] socket(AF_INET, SOCK_STREAM|SOCK_CLOEXEC, IPPROTO_SCTP [pid 5244] futex(0x7fcbc71f642c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5247] <... socket resumed>) = 3 [pid 5247] futex(0x7fcbc71f642c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5244] <... futex resumed>) = 0 [pid 5247] futex(0x7fcbc71f6428, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5244] futex(0x7fcbc71f6428, FUTEX_WAKE_PRIVATE, 1000000 [pid 5247] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5244] <... futex resumed>) = 0 [pid 5247] write(8, NULL, 4 [pid 5244] futex(0x7fcbc71f642c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5247] <... write resumed>) = -1 EBADF (Bad file descriptor) [pid 5247] futex(0x7fcbc71f642c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5244] <... futex resumed>) = 0 [pid 5247] futex(0x7fcbc71f6428, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5244] futex(0x7fcbc71f6428, FUTEX_WAKE_PRIVATE, 1000000 [pid 5247] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5244] <... futex resumed>) = 0 [pid 5247] bind(5, {sa_family=AF_BLUETOOTH, hci_dev=htobs(65535), hci_channel=HCI_CHANNEL_CONTROL}, 6 [pid 5244] futex(0x7fcbc71f642c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5247] <... bind resumed>) = 0 [pid 5247] futex(0x7fcbc71f642c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5244] <... futex resumed>) = 0 [pid 5247] write(5, "\x05\x00\x00\x00\x01\x00\x00", 7 [pid 5244] futex(0x7fcbc71f6428, FUTEX_WAKE_PRIVATE, 1000000 [pid 5247] <... write resumed>) = 7 [pid 5244] <... futex resumed>) = 0 [pid 5247] futex(0x7fcbc71f642c, FUTEX_WAKE_PRIVATE, 1000000 [pid 5245] <... ioctl resumed>, 0x200000c0) = -1 EHOSTDOWN (Host is down) [pid 5244] futex(0x7fcbc71f642c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5247] <... futex resumed>) = 0 [pid 5247] futex(0x7fcbc71f6428, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5246] <... ioctl resumed>, 0) = 0 [pid 5245] futex(0x7fcbc71f640c, FUTEX_WAKE_PRIVATE, 1000000 [pid 5244] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5245] <... futex resumed>) = 0 [ 63.233980][ T5247] Bluetooth: MGMT ver 1.23 [ 63.239222][ T5245] Bluetooth: hci0: Opcode 0x0401 failed: -112 [ 63.252083][ T54] ================================================================== [ 63.260186][ T54] BUG: KASAN: slab-use-after-free in set_powered_sync+0x3a/0xc0 [ 63.267860][ T54] Read of size 8 at addr ffff888029b4dd18 by task kworker/u9:0/54 [ 63.275765][ T54] [pid 5245] futex(0x7fcbc71f6408, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5246] futex(0x7fcbc71f641c, FUTEX_WAKE_PRIVATE, 1000000 [pid 5244] close(3 [pid 5246] <... futex resumed>) = 0 [pid 5244] <... close resumed>) = 0 [pid 5246] futex(0x7fcbc71f6418, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5244] close(4) = 0 [pid 5244] close(5) = 0 [ 63.278115][ T54] CPU: 1 UID: 0 PID: 54 Comm: kworker/u9:0 Not tainted 6.11.0-rc6-syzkaller-01155-gf723224742fc #0 [ 63.288796][ T54] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024 [ 63.298850][ T54] Workqueue: hci0 hci_cmd_sync_work [ 63.304057][ T54] Call Trace: [ 63.307321][ T54] [ 63.310249][ T54] dump_stack_lvl+0x241/0x360 [ 63.314938][ T54] ? __pfx_dump_stack_lvl+0x10/0x10 [ 63.320148][ T54] ? __pfx__printk+0x10/0x10 [ 63.324732][ T54] ? _printk+0xd5/0x120 [ 63.328878][ T54] ? __virt_addr_valid+0x183/0x530 [ 63.334328][ T54] ? __virt_addr_valid+0x183/0x530 [ 63.339422][ T54] print_report+0x169/0x550 [ 63.343921][ T54] ? __virt_addr_valid+0x183/0x530 [ 63.349030][ T54] ? __virt_addr_valid+0x183/0x530 [ 63.354128][ T54] ? __virt_addr_valid+0x45f/0x530 [ 63.359230][ T54] ? __phys_addr+0xba/0x170 [ 63.363720][ T54] ? set_powered_sync+0x3a/0xc0 [ 63.368556][ T54] kasan_report+0x143/0x180 [ 63.373053][ T54] ? set_powered_sync+0x3a/0xc0 [ 63.377892][ T54] set_powered_sync+0x3a/0xc0 [ 63.382553][ T54] ? __pfx_set_powered_sync+0x10/0x10 [ 63.387911][ T54] hci_cmd_sync_work+0x22b/0x400 [ 63.392836][ T54] ? process_scheduled_works+0x945/0x1830 [ 63.398552][ T54] process_scheduled_works+0xa2c/0x1830 [ 63.404094][ T54] ? __pfx_process_scheduled_works+0x10/0x10 [ 63.410063][ T54] ? assign_work+0x364/0x3d0 [ 63.414644][ T54] worker_thread+0x86d/0xd10 [ 63.419232][ T54] ? __kthread_parkme+0x169/0x1d0 [ 63.424247][ T54] ? __pfx_worker_thread+0x10/0x10 [ 63.429345][ T54] kthread+0x2f0/0x390 [ 63.433405][ T54] ? __pfx_worker_thread+0x10/0x10 [ 63.438501][ T54] ? __pfx_kthread+0x10/0x10 [ 63.443082][ T54] ret_from_fork+0x4b/0x80 [ 63.447756][ T54] ? __pfx_kthread+0x10/0x10 [ 63.452342][ T54] ret_from_fork_asm+0x1a/0x30 [ 63.457108][ T54] [ 63.460109][ T54] [ 63.462412][ T54] Allocated by task 5247: [ 63.466719][ T54] kasan_save_track+0x3f/0x80 [ 63.471385][ T54] __kasan_kmalloc+0x98/0xb0 [ 63.475962][ T54] __kmalloc_cache_noprof+0x19c/0x2c0 [ 63.481325][ T54] mgmt_pending_new+0x65/0x250 [ 63.486082][ T54] mgmt_pending_add+0x36/0x120 [ 63.490836][ T54] set_powered+0x3cd/0x5e0 [ 63.495249][ T54] hci_mgmt_cmd+0xc47/0x11d0 [ 63.499829][ T54] hci_sock_sendmsg+0x7b8/0x11c0 [ 63.504747][ T54] __sock_sendmsg+0x221/0x270 [ 63.509407][ T54] sock_write_iter+0x2dd/0x400 [ 63.514163][ T54] vfs_write+0xa72/0xc90 [ 63.518388][ T54] ksys_write+0x1a0/0x2c0 [ 63.522706][ T54] do_syscall_64+0xf3/0x230 [ 63.527197][ T54] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 63.533083][ T54] [ 63.535388][ T54] Freed by task 5246: [ 63.539345][ T54] kasan_save_track+0x3f/0x80 [ 63.544015][ T54] kasan_save_free_info+0x40/0x50 [ 63.549024][ T54] poison_slab_object+0xe0/0x150 [ 63.553948][ T54] __kasan_slab_free+0x37/0x60 [ 63.558700][ T54] kfree+0x149/0x360 [ 63.562749][ T54] settings_rsp+0x2bc/0x390 [ 63.567245][ T54] mgmt_pending_foreach+0xd1/0x130 [ 63.572349][ T54] __mgmt_power_off+0x112/0x420 [ 63.577181][ T54] hci_dev_close_sync+0x665/0x11a0 [ 63.582284][ T54] hci_dev_close+0x112/0x210 [ 63.586862][ T54] sock_do_ioctl+0x158/0x460 [ 63.591434][ T54] sock_ioctl+0x629/0x8e0 [ 63.595749][ T54] __se_sys_ioctl+0xfc/0x170 [ 63.600321][ T54] do_syscall_64+0xf3/0x230 [ 63.604829][ T54] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 63.610710][ T54] [ 63.613028][ T54] The buggy address belongs to the object at ffff888029b4dd00 [ 63.613028][ T54] which belongs to the cache kmalloc-96 of size 96 [ 63.626888][ T54] The buggy address is located 24 bytes inside of [ 63.626888][ T54] freed 96-byte region [ffff888029b4dd00, ffff888029b4dd60) [ 63.640493][ T54] [ 63.642806][ T54] The buggy address belongs to the physical page: [ 63.649208][ T54] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x29b4d [ 63.657979][ T54] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) [ 63.665081][ T54] page_type: 0xfdffffff(slab) [ 63.669746][ T54] raw: 00fff00000000000 ffff88801ac41280 dead000000000100 dead000000000122 [ 63.678314][ T54] raw: 0000000000000000 0000000080200020 00000001fdffffff 0000000000000000 [ 63.687052][ T54] page dumped because: kasan: bad access detected [ 63.693453][ T54] page_owner tracks the page as allocated [ 63.699157][ T54] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x52cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 1, tgid 1 (swapper/0), ts 9062203522, free_ts 0 [ 63.717030][ T54] post_alloc_hook+0x1f3/0x230 [ 63.721787][ T54] get_page_from_freelist+0x2e4c/0x2f10 [ 63.727331][ T54] __alloc_pages_noprof+0x256/0x6c0 [ 63.732526][ T54] alloc_slab_page+0x5f/0x120 [ 63.737195][ T54] allocate_slab+0x5a/0x2f0 [ 63.741683][ T54] ___slab_alloc+0xcd1/0x14b0 [ 63.746345][ T54] __slab_alloc+0x58/0xa0 [ 63.750659][ T54] __kmalloc_cache_noprof+0x1d5/0x2c0 [ 63.756014][ T54] usb_hub_create_port_device+0xc8/0xc10 [ 63.761642][ T54] hub_probe+0x2503/0x3640 [ 63.766045][ T54] usb_probe_interface+0x645/0xbb0 [ 63.771160][ T54] really_probe+0x2b8/0xad0 [ 63.775656][ T54] __driver_probe_device+0x1a2/0x390 [ 63.780923][ T54] driver_probe_device+0x50/0x430 [ 63.786019][ T54] __device_attach_driver+0x2d6/0x530 [ 63.791374][ T54] bus_for_each_drv+0x24e/0x2e0 [ 63.796301][ T54] page_owner free stack trace missing [ 63.801648][ T54] [ 63.803955][ T54] Memory state around the buggy address: [ 63.809567][ T54] ffff888029b4dc00: 00 00 00 00 00 00 00 00 00 00 fc fc fc fc fc fc [ 63.817611][ T54] ffff888029b4dc80: 00 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc [ 63.825660][ T54] >ffff888029b4dd00: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc [pid 5244] close(6) = 0 [pid 5244] close(7) = -1 EBADF (Bad file descriptor) [pid 5244] close(8) = -1 EBADF (Bad file descriptor) [pid 5244] close(9) = -1 EBADF (Bad file descriptor) [pid 5244] close(10) = -1 EBADF (Bad file descriptor) [pid 5244] close(11) = -1 EBADF (Bad file descriptor) [pid 5244] close(12) = -1 EBADF (Bad file descriptor) [ 63.833877][ T54] ^ [ 63.838709][ T54] ffff888029b4dd80: 00 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc [ 63.846754][ T54] ffff888029b4de00: 00 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc [ 63.854796][ T54] ================================================================== [ 63.870297][ T54] Kernel panic - not syncing: KASAN: panic_on_warn set ... [pid 5244] close(13) = -1 EBADF (Bad file descriptor) [pid 5244] close(14) = -1 EBADF (Bad file descriptor) [pid 5244] close(15) = -1 EBADF (Bad file descriptor) [pid 5244] close(16) = -1 EBADF (Bad file descriptor) [pid 5244] close(17) = -1 EBADF (Bad file descriptor) [pid 5244] close(18) = -1 EBADF (Bad file descriptor) [pid 5244] close(19) = -1 EBADF (Bad file descriptor) [pid 5244] close(20) = -1 EBADF (Bad file descriptor) [pid 5244] close(21) = -1 EBADF (Bad file descriptor) [pid 5244] close(22) = -1 EBADF (Bad file descriptor) [pid 5244] close(23) = -1 EBADF (Bad file descriptor) [pid 5244] close(24) = -1 EBADF (Bad file descriptor) [pid 5244] close(25) = -1 EBADF (Bad file descriptor) [pid 5244] close(26) = -1 EBADF (Bad file descriptor) [pid 5244] close(27) = -1 EBADF (Bad file descriptor) [pid 5244] close(28) = -1 EBADF (Bad file descriptor) [pid 5244] close(29) = -1 EBADF (Bad file descriptor) [pid 5244] exit_group(0) = ? [pid 5245] <... futex resumed>) = ? [pid 5245] +++ exited with 0 +++ [pid 5247] <... futex resumed>) = ? [pid 5246] <... futex resumed>) = ? [pid 5247] +++ exited with 0 +++ [pid 5246] +++ exited with 0 +++ [pid 5244] +++ exited with 0 +++ [pid 5231] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=3, si_uid=0, si_status=0, si_utime=0, si_stime=5 /* 0.05 s */} --- [ 63.877528][ T54] CPU: 1 UID: 0 PID: 54 Comm: kworker/u9:0 Not tainted 6.11.0-rc6-syzkaller-01155-gf723224742fc #0 [ 63.888213][ T54] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024 [ 63.898280][ T54] Workqueue: hci0 hci_cmd_sync_work [ 63.903521][ T54] Call Trace: [ 63.906809][ T54] [ 63.909734][ T54] dump_stack_lvl+0x241/0x360 [ 63.914413][ T54] ? __pfx_dump_stack_lvl+0x10/0x10 [ 63.919606][ T54] ? __pfx__printk+0x10/0x10 [ 63.924186][ T54] ? preempt_schedule+0xe1/0xf0 [ 63.929034][ T54] ? vscnprintf+0x5d/0x90 [ 63.933357][ T54] panic+0x349/0x860 [ 63.937331][ T54] ? check_panic_on_warn+0x21/0xb0 [ 63.942434][ T54] ? __pfx_panic+0x10/0x10 [ 63.946840][ T54] ? _raw_spin_unlock_irqrestore+0x130/0x140 [ 63.952810][ T54] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 63.959217][ T54] ? print_report+0x502/0x550 [ 63.963891][ T54] check_panic_on_warn+0x86/0xb0 [ 63.968817][ T54] ? set_powered_sync+0x3a/0xc0 [ 63.973657][ T54] end_report+0x77/0x160 [ 63.977894][ T54] kasan_report+0x154/0x180 [ 63.982390][ T54] ? set_powered_sync+0x3a/0xc0 [ 63.987234][ T54] set_powered_sync+0x3a/0xc0 [ 63.991986][ T54] ? __pfx_set_powered_sync+0x10/0x10 [ 63.997345][ T54] hci_cmd_sync_work+0x22b/0x400 [ 64.002272][ T54] ? process_scheduled_works+0x945/0x1830 [ 64.007982][ T54] process_scheduled_works+0xa2c/0x1830 [ 64.013530][ T54] ? __pfx_process_scheduled_works+0x10/0x10 [ 64.019501][ T54] ? assign_work+0x364/0x3d0 [ 64.024175][ T54] worker_thread+0x86d/0xd10 [ 64.028782][ T54] ? __kthread_parkme+0x169/0x1d0 [ 64.033831][ T54] ? __pfx_worker_thread+0x10/0x10 [ 64.038959][ T54] kthread+0x2f0/0x390 [ 64.043029][ T54] ? __pfx_worker_thread+0x10/0x10 [ 64.048133][ T54] ? __pfx_kthread+0x10/0x10 [ 64.052715][ T54] ret_from_fork+0x4b/0x80 [ 64.057124][ T54] ? __pfx_kthread+0x10/0x10 [ 64.061705][ T54] ret_from_fork_asm+0x1a/0x30 [ 64.066465][ T54] [ 64.069684][ T54] Kernel Offset: disabled [ 64.074004][ T54] Rebooting in 86400 seconds..