ci-upstream-rust-kasan-gce/strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ci-upstream-rust-kasan-gce/syz-executor1197130129

<...>
Warning: Permanently added '10.128.1.11' (ED25519) to the list of known hosts.
execve("ci-upstream-rust-kasan-gce/syz-executor1197130129", ["ci-upstream-rust-kasan-gce/syz-executor1197130129"], 0x7fff3c673e50 /* 10 vars */) = 0
brk(NULL)                               = 0x55558ea92000
brk(0x55558ea92d80)                     = 0x55558ea92d80
arch_prctl(ARCH_SET_FS, 0x55558ea92400) = 0
set_tid_address(0x55558ea926d0)         = 5628
set_robust_list(0x55558ea926e0, 24)     = 0
rseq({cpu_id_start=0, cpu_id=RSEQ_CPU_ID_UNINITIALIZED, rseq_cs=NULL, flags=0, node_id=0, mm_cid=0, slice_ctrl={request=0, granted=0, __reserved=0}, __reserved=0}, 33, 0, 0x53053053) = 0
prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0
readlinkat(AT_FDCWD, "/proc/self/exe", "/root/ci-upstream-rust-kasan-gce/syz-executor1197130129", 4096) = 55
getrandom("\x57\x05\x69\x58\x3c\xd3\x75\x0b", 8, GRND_NONBLOCK) = 8
brk(NULL)                               = 0x55558ea92d80
brk(0x55558eab3d80)                     = 0x55558eab3d80
brk(0x55558eab4000)                     = 0x55558eab4000
mprotect(0x7f523b276000, 20480, PROT_READ) = 0
mmap(0x1ffffffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffffffff000
mmap(0x200000000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200000000000
mmap(0x200001000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200001000000
unshare(CLONE_NEWPID)                   = 0
rt_sigprocmask(SIG_BLOCK, ~[], [], 8)   = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci-upstream-rust-kasan-gce/strace-static-x86_64: Process 5629 attached
, child_tidptr=0x55558ea926d0) = 5629
[pid  5629] set_robust_list(0x55558ea926e0, 24 <unfinished ...>
[pid  5628] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid  5629] <... set_robust_list resumed>) = 0
[pid  5629] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid  5629] socket(AF_BLUETOOTH, SOCK_RAW, BTPROTO_HCI) = 3
[pid  5629] openat(AT_FDCWD, "/dev/vhci", O_RDWR) = 4
[pid  5629] dup2(4, 202)                = 202
[pid  5629] close(4)                    = 0
[pid  5629] write(202, "\xff\x00", 2)   = 2
[pid  5629] read(202, "\xff\x00\x00\x00", 4) = 4
[pid  5629] rt_sigaction(SIGRT_1, {sa_handler=0x7f523b1ddb90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f523b1cfe80}, NULL, 8) = 0
[pid  5629] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0
[pid  5629] mmap(NULL, 8392704, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f523a9a2000
[pid  5629] mprotect(0x7f523a9a3000, 8388608, PROT_READ|PROT_WRITE) = 0
[pid  5629] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
[pid  5629] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f523b1a2990, parent_tid=0x7f523b1a2990, exit_signal=0, stack=0x7f523a9a2000, stack_size=0x8002c0, tls=0x7f523b1a26c0}ci-upstream-rust-kasan-gce/strace-static-x86_64: Process 5632 attached
 => {parent_tid=[2]}, 88) = 2
[pid  5629] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  5632] rseq({cpu_id_start=0, cpu_id=RSEQ_CPU_ID_UNINITIALIZED, rseq_cs=NULL, flags=0, node_id=0, mm_cid=0, slice_ctrl={request=0, granted=0, __reserved=0}, __reserved=0}, 33, 0, 0x53053053 <unfinished ...>
[pid  5629] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  5632] <... rseq resumed>)         = 0
[pid  5629] ioctl(3, HCIDEVUP, 0 <unfinished ...>
[pid  5632] set_robust_list(0x7f523b1a29a0, 24) = 0
[pid  5632] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid  5632] read(202, "\x01\x03\x0c\x00", 1024) = 4
[pid  5632] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x0e\xfc", iov_len=2}, {iov_base="\x01\x03\x0c", iov_len=3}, {iov_base="\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., iov_len=249}], 4) = 255
[pid  5632] read(202, "\x01\x03\x10\x00", 1024) = 4
[pid  5632] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x0e\xfc", iov_len=2}, {iov_base="\x01\x03\x10", iov_len=3}, {iov_base="\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., iov_len=249}], 4) = 255
[pid  5632] read(202, "\x01\x01\x10\x00", 1024) = 4
[pid  5632] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x0e\xfc", iov_len=2}, {iov_base="\x01\x01\x10", iov_len=3}, {iov_base="\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., iov_len=249}], 4) = 255
[pid  5632] read(202, "\x01\x09\x10\x00", 1024) = 4
[pid  5632] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x0e\x0a", iov_len=2}, {iov_base="\x01\x09\x10", iov_len=3}, {iov_base="\x00\xaa\xaa\xaa\xaa\xaa\xaa", iov_len=7}], 4) = 13
[pid  5632] read(202, "\x01\x05\x10\x00", 1024) = 4
[pid  5632] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x0e\x0b", iov_len=2}, {iov_base="\x01\x05\x10", iov_len=3}, {iov_base="\x00\xfd\x03\x60\x04\x00\x06\x00", iov_len=8}], 4) = 14
[pid  5632] read(202, "\x01\x23\x0c\x00", 1024) = 4
[pid  5632] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x0e\xfc", iov_len=2}, {iov_base="\x01\x23\x0c", iov_len=3}, {iov_base="\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., iov_len=249}], 4) = 255
[pid  5632] read(202, "\x01\x14\x0c\x00", 1024) = 4
[pid  5632] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x0e\xfc", iov_len=2}, {iov_base="\x01\x14\x0c", iov_len=3}, {iov_base="\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., iov_len=249}], 4) = 255
[pid  5632] read(202, "\x01\x38\x0c\x00", 1024) = 4
[pid  5632] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x0e\xfc", iov_len=2}, {iov_base="\x01\x38\x0c", iov_len=3}, {iov_base="\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., iov_len=249}], 4) = 255
[pid  5632] read(202, "\x01\x39\x0c\x00", 1024) = 4
[pid  5632] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x0e\xfc", iov_len=2}, {iov_base="\x01\x39\x0c", iov_len=3}, {iov_base="\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., iov_len=249}], 4) = 255
[pid  5632] read(202, "\x01\x16\x0c\x02\x00\x7d", 1024) = 6
[pid  5632] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x0e\xfc", iov_len=2}, {iov_base="\x01\x16\x0c", iov_len=3}, {iov_base="\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., iov_len=249}], 4) = 255
[pid  5629] <... ioctl resumed>)        = -1 EALREADY (Operation already in progress)
[pid  5632] read(202 <unfinished ...>
[pid  5629] ioctl(3, HCISETSCAN, 0x7ffc7b1a017c <unfinished ...>
[pid  5632] <... read resumed>, "\x01\x1a\x0c\x01\x02", 1024) = 5
[pid  5632] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x0e\x04", iov_len=2}, {iov_base="\x01\x1a\x0c", iov_len=3}, {iov_base="\x00", iov_len=1}], 4) = 7
[pid  5632] rt_sigprocmask(SIG_BLOCK, ~[RT_1] <unfinished ...>
[pid  5629] <... ioctl resumed>)        = 0
[pid  5632] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  5629] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x04\x0a", iov_len=2}, {iov_base="\xaa\xaa\xaa\xaa\xaa\x10\x00\x00\x00\x01", iov_len=10}], 3 <unfinished ...>
[pid  5632] madvise(0x7f523a9a2000, 8372224, MADV_DONTNEED <unfinished ...>
[pid  5629] <... writev resumed>)       = 13
[pid  5632] <... madvise resumed>)      = 0
[pid  5632] exit(0 <unfinished ...>
[pid  5629] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x03\x0b", iov_len=2}, {iov_base="\x00\xc8\x00\xaa\xaa\xaa\xaa\xaa\x10\x01\x00", iov_len=11}], 3 <unfinished ...>
[pid  5632] <... exit resumed>)         = ?
[pid  5629] <... writev resumed>)       = 14
[pid  5632] +++ exited with 0 +++
[pid  5629] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\v\v", iov_len=2}, {iov_base="\x00\xc8\x00\x00\x00\x00\x00\x00\x00\x00\x00", iov_len=11}], 3) = 14
[pid  5629] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x3e\x13", iov_len=2}, {iov_base="\x01\x00\xc9\x00\x01\x00\xaa\xaa\xaa\xaa\xaa\x11\x00\x00\x00\x00\x00\x00\x00", iov_len=19}], 3) = 22
[pid  5629] close(3)                    = 0
[pid  5629] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5629] getppid()                   = 0
[pid  5629] openat(AT_FDCWD, "/proc/self/ns/net", O_RDONLY) = 3
[pid  5629] dup2(3, 201)                = 201
[pid  5629] close(3)                    = 0
[pid  5629] prlimit64(0, RLIMIT_AS, {rlim_cur=204800*1024, rlim_max=204800*1024}, NULL) = 0
[pid  5629] prlimit64(0, RLIMIT_MEMLOCK, {rlim_cur=32768*1024, rlim_max=32768*1024}, NULL) = 0
[pid  5629] prlimit64(0, RLIMIT_FSIZE, {rlim_cur=139264*1024, rlim_max=139264*1024}, NULL) = 0
[pid  5629] prlimit64(0, RLIMIT_STACK, {rlim_cur=1024*1024, rlim_max=1024*1024}, NULL) = 0
[pid  5629] prlimit64(0, RLIMIT_CORE, {rlim_cur=131072*1024, rlim_max=131072*1024}, NULL) = 0
[pid  5629] prlimit64(0, RLIMIT_NOFILE, {rlim_cur=256, rlim_max=256}, NULL) = 0
[pid  5629] unshare(CLONE_NEWNS)        = 0
[pid  5629] mount(NULL, "/", NULL, MS_REC|MS_PRIVATE, NULL) = 0
[pid  5629] unshare(CLONE_NEWIPC)       = 0
[pid  5629] unshare(CLONE_NEWCGROUP)    = 0
[pid  5629] unshare(CLONE_NEWUTS)       = 0
[pid  5629] unshare(CLONE_SYSVSEM)      = 0
[pid  5629] openat(AT_FDCWD, "/proc/sys/kernel/shmmax", O_WRONLY|O_CLOEXEC) = 3
[pid  5629] write(3, "16777216", 8)     = 8
[pid  5629] close(3)                    = 0
[pid  5629] openat(AT_FDCWD, "/proc/sys/kernel/shmall", O_WRONLY|O_CLOEXEC) = 3
[pid  5629] write(3, "536870912", 9)    = 9
[   80.309566][ T5630] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[   80.311850][ T5630] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[   80.312726][ T5630] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[   80.315012][ T5630] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[   80.316533][ T5630] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[pid  5629] close(3)                    = 0
[pid  5629] openat(AT_FDCWD, "/proc/sys/kernel/shmmni", O_WRONLY|O_CLOEXEC) = 3
[pid  5629] write(3, "1024", 4)         = 4
[pid  5629] close(3)                    = 0
[pid  5629] openat(AT_FDCWD, "/proc/sys/kernel/msgmax", O_WRONLY|O_CLOEXEC) = 3
[pid  5629] write(3, "8192", 4)         = 4
[pid  5629] close(3)                    = 0
[pid  5629] openat(AT_FDCWD, "/proc/sys/kernel/msgmni", O_WRONLY|O_CLOEXEC) = 3
[pid  5629] write(3, "1024", 4)         = 4
[pid  5629] close(3)                    = 0
[pid  5629] openat(AT_FDCWD, "/proc/sys/kernel/msgmnb", O_WRONLY|O_CLOEXEC) = 3
[pid  5629] write(3, "1024", 4)         = 4
[pid  5629] close(3)                    = 0
[pid  5629] openat(AT_FDCWD, "/proc/sys/kernel/sem", O_WRONLY|O_CLOEXEC) = 3
[pid  5629] write(3, "1024 1048576 500 1024", 21) = 21
[pid  5629] close(3)                    = 0
[pid  5629] getpid()                    = 1
[pid  5629] capget({version=_LINUX_CAPABILITY_VERSION_3, pid=1}, {effective=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PTRACE|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_NICE|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ|1<<CAP_PERFMON|1<<CAP_BPF|1<<CAP_CHECKPOINT_RESTORE, permitted=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PTRACE|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_NICE|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ|1<<CAP_PERFMON|1<<CAP_BPF|1<<CAP_CHECKPOINT_RESTORE, inheritable=0}) = 0
[pid  5629] capset({version=_LINUX_CAPABILITY_VERSION_3, pid=1}, {effective=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ|1<<CAP_PERFMON|1<<CAP_BPF|1<<CAP_CHECKPOINT_RESTORE, permitted=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ|1<<CAP_PERFMON|1<<CAP_BPF|1<<CAP_CHECKPOINT_RESTORE, inheritable=0}) = 0
[pid  5629] unshare(CLONE_NEWNET)       = 0
[pid  5629] openat(AT_FDCWD, "/proc/sys/net/ipv4/ping_group_range", O_WRONLY|O_CLOEXEC) = 3
[pid  5629] write(3, "0 65535", 7)      = 7
[pid  5629] close(3)                    = 0
[pid  5629] openat(AT_FDCWD, "/proc/sys/fs/mount-max", O_WRONLY|O_CLOEXEC) = 3
[pid  5629] write(3, "100000", 6)       = 6
[pid  5629] close(3)                    = 0
[pid  5629] mkdir("./syz-tmp", 0777)    = 0
[pid  5629] mount("", "./syz-tmp", "tmpfs", 0, NULL) = 0
[pid  5629] mkdir("./syz-tmp/newroot", 0777) = 0
[pid  5629] mkdir("./syz-tmp/newroot/dev", 0700) = 0
[pid  5629] mount("/dev", "./syz-tmp/newroot/dev", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL) = 0
[pid  5629] mkdir("./syz-tmp/newroot/proc", 0700) = 0
[pid  5629] mount("syz-proc", "./syz-tmp/newroot/proc", "proc", 0, NULL) = 0
[pid  5629] mkdir("./syz-tmp/newroot/selinux", 0700) = 0
[pid  5629] mount("/selinux", "./syz-tmp/newroot/selinux", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL) = -1 ENOENT (No such file or directory)
[pid  5629] mount("/sys/fs/selinux", "./syz-tmp/newroot/selinux", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL) = -1 ENOENT (No such file or directory)
[pid  5629] mkdir("./syz-tmp/newroot/sys", 0700) = 0
[pid  5629] mount("/sys", "./syz-tmp/newroot/sys", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL) = 0
[pid  5629] mount("/sys/kernel/debug", "./syz-tmp/newroot/sys/kernel/debug", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL) = 0
[pid  5629] mount("/sys/fs/smackfs", "./syz-tmp/newroot/sys/fs/smackfs", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL) = -1 ENOENT (No such file or directory)
[pid  5629] mount("/proc/sys/fs/binfmt_misc", "./syz-tmp/newroot/proc/sys/fs/binfmt_misc", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL) = 0
[pid  5629] mkdir("./syz-tmp/newroot/syz-inputs", 0700) = 0
[pid  5629] mount("/syz-inputs", "./syz-tmp/newroot/syz-inputs", NULL, MS_RDONLY|MS_BIND|MS_REC|MS_PRIVATE, NULL) = -1 ENOENT (No such file or directory)
[pid  5629] mkdir("./syz-tmp/pivot", 0777) = 0
[pid  5629] pivot_root("./syz-tmp", "./syz-tmp/pivot") = 0
[pid  5629] chdir("/")                  = 0
[pid  5629] umount2("./pivot", MNT_DETACH) = 0
[pid  5629] chroot("./newroot")         = 0
[pid  5629] chdir("/")                  = 0
[pid  5629] mkdir("/dev/gadgetfs", 0777) = 0
[pid  5629] mount("gadgetfs", "/dev/gadgetfs", "gadgetfs", 0, NULL) = 0
[pid  5629] mkdir("/dev/binderfs", 0777) = 0
[pid  5629] mount("binder", "/dev/binderfs", "binder", 0, NULL) = 0
[pid  5629] symlink("/dev/binderfs", "./binderfs") = 0
[pid  5629] mount(NULL, "/sys/fs/fuse/connections", "fusectl", 0, NULL) = -1 EBUSY (Device or resource busy)
[pid  5629] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
[pid  5629] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci-upstream-rust-kasan-gce/strace-static-x86_64: Process 5635 attached
, child_tidptr=0x55558ea926d0) = 3
[pid  5635] set_robust_list(0x55558ea926e0, 24) = 0
[pid  5635] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  5629] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid  5635] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  5635] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5635] setpgid(0, 0)               = 0
[pid  5635] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5635] write(3, "1000", 4)         = 4
[pid  5635] close(3)                    = 0
[pid  5635] write(1, "executing program\n", 18) = 18
[pid  5635] write(202, "\x04\x06\x03\x00\xc9\x00", 6) = 6
executing program
[pid  5635] openat(AT_FDCWD, "/proc/self/ns/net", O_RDONLY) = 3
[pid  5635] setns(201, 0)               = 0
[pid  5635] socket(AF_BLUETOOTH, SOCK_STREAM, BTPROTO_RFCOMM) = 4
[pid  5635] setns(3, 0)                 = 0
[pid  5635] close(3)                    = 0
[   80.658309][ T5635] 
[   80.660676][ T5635] ======================================================
[   80.667692][ T5635] WARNING: possible circular locking dependency detected
[   80.674805][ T5635] syzkaller #0 Not tainted
[   80.679395][ T5635] ------------------------------------------------------
[   80.686427][ T5635] syz-executor119/5635 is trying to acquire lock:
[   80.693021][ T5635] ffff8880793dc0b8 (&hdev->lock){+.+.}-{4:4}, at: l2cap_chan_connect+0xff/0xf60
[   80.702097][ T5635] 
[   80.702097][ T5635] but task is already holding lock:
[   80.709558][ T5635] ffffffff90611e00 (rfcomm_mutex){+.+.}-{4:4}, at: rfcomm_dlc_open+0x9c/0x1080
[   80.719063][ T5635] 
[   80.719063][ T5635] which lock already depends on the new lock.
[   80.719063][ T5635] 
[   80.729569][ T5635] 
[   80.729569][ T5635] the existing dependency chain (in reverse order) is:
[   80.738681][ T5635] 
[   80.738681][ T5635] -> #2 (rfcomm_mutex){+.+.}-{4:4}:
[   80.746615][ T5635]        __mutex_lock+0x19d/0x1550
[   80.751774][ T5635]        rfcomm_security_cfm+0x90/0x820
[   80.757339][ T5635]        hci_auth_complete_evt+0x39f/0xc80
[   80.763149][ T5635]        hci_event_packet+0x6cd/0xf10
[   80.768528][ T5635]        hci_rx_work+0x3ee/0x1020
[   80.773552][ T5635]        process_scheduled_works+0xc3d/0x1630
[   80.779814][ T5635]        worker_thread+0xa47/0xfb0
[   80.784925][ T5635]        kthread+0x38b/0x480
[   80.789521][ T5635]        ret_from_fork+0x514/0xb70
[   80.794649][ T5635]        ret_from_fork_asm+0x1a/0x30
[   80.799940][ T5635] 
[   80.799940][ T5635] -> #1 (hci_cb_list_lock){+.+.}-{4:4}:
[   80.807695][ T5635]        __mutex_lock+0x19d/0x1550
[   80.812990][ T5635]        hci_remote_features_evt+0x53d/0x950
[   80.819322][ T5635]        hci_event_packet+0x6cd/0xf10
[   80.824695][ T5635]        hci_rx_work+0x3ee/0x1020
[   80.829815][ T5635]        process_scheduled_works+0xc3d/0x1630
[   80.836006][ T5635]        worker_thread+0xa47/0xfb0
[   80.841149][ T5635]        kthread+0x38b/0x480
[   80.845805][ T5635]        ret_from_fork+0x514/0xb70
[   80.850970][ T5635]        ret_from_fork_asm+0x1a/0x30
[   80.856470][ T5635] 
[   80.856470][ T5635] -> #0 (&hdev->lock){+.+.}-{4:4}:
[   80.863787][ T5635]        __lock_acquire+0x15ff/0x2e50
[   80.869189][ T5635]        lock_acquire+0x115/0x350
[   80.874494][ T5635]        __mutex_lock+0x19d/0x1550
[   80.879739][ T5635]        l2cap_chan_connect+0xff/0xf60
[   80.885214][ T5635]        l2cap_sock_connect+0x5e4/0x7e0
[   80.890796][ T5635]        kernel_connect+0x141/0x1c0
[   80.896222][ T5635]        rfcomm_dlc_open+0x644/0x1080
[   80.901699][ T5635]        rfcomm_sock_connect+0x2ed/0x650
[   80.907340][ T5635]        __sys_connect+0x316/0x450
[   80.912559][ T5635]        __x64_sys_connect+0x7a/0x90
[   80.917850][ T5635]        do_syscall_64+0x166/0x520
[   80.923052][ T5635]        entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   80.929645][ T5635] 
[   80.929645][ T5635] other info that might help us debug this:
[   80.929645][ T5635] 
[   80.939966][ T5635] Chain exists of:
[   80.939966][ T5635]   &hdev->lock --> hci_cb_list_lock --> rfcomm_mutex
[   80.939966][ T5635] 
[   80.952594][ T5635]  Possible unsafe locking scenario:
[   80.952594][ T5635] 
[   80.960147][ T5635]        CPU0                    CPU1
[   80.965607][ T5635]        ----                    ----
[   80.970995][ T5635]   lock(rfcomm_mutex);
[   80.975435][ T5635]                                lock(hci_cb_list_lock);
[   80.982464][ T5635]                                lock(rfcomm_mutex);
[   80.989337][ T5635]   lock(&hdev->lock);
[   80.993689][ T5635] 
[   80.993689][ T5635]  *** DEADLOCK ***
[   80.993689][ T5635] 
[   81.001839][ T5635] locks held by syz-executor119/5635: 1, last CPU#0:
[   81.008521][ T5635]  #0: ffffffff90611e00 (rfcomm_mutex){+.+.}-{4:4}, at: rfcomm_dlc_open+0x9c/0x1080
[   81.017949][ T5635] 
[   81.017949][ T5635] stack backtrace:
[   81.024224][ T5635] CPU: 0 UID: 0 PID: 5635 Comm: syz-executor119 Not tainted syzkaller #0 PREEMPT(full) 
[   81.034056][ T5635] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
[   81.044497][ T5635] Call Trace:
[   81.047795][ T5635]  <TASK>
[   81.050738][ T5635]  dump_stack_lvl+0xe8/0x150
[   81.055343][ T5635]  print_circular_bug+0x2e2/0x300
[   81.060374][ T5635]  check_noncircular+0x12f/0x150
[   81.065358][ T5635]  __lock_acquire+0x15ff/0x2e50
[   81.070251][ T5635]  ? lockdep_unlock+0x5c/0xd0
[   81.074953][ T5635]  ? __lock_acquire+0x14b9/0x2e50
[   81.080179][ T5635]  lock_acquire+0x115/0x350
[   81.084696][ T5635]  ? l2cap_chan_connect+0xff/0xf60
[   81.089828][ T5635]  __mutex_lock+0x19d/0x1550
[   81.094446][ T5635]  ? l2cap_chan_connect+0xff/0xf60
[   81.099587][ T5635]  ? l2cap_chan_connect+0xff/0xf60
[   81.104745][ T5635]  ? _raw_read_unlock+0x28/0x50
[   81.109701][ T5635]  ? __pfx___mutex_lock+0x10/0x10
[   81.114818][ T5635]  ? __pfx_hci_get_route+0x10/0x10
[   81.119962][ T5635]  ? stack_trace_save+0xa9/0x100
[   81.124923][ T5635]  ? __pfx_stack_trace_save+0x10/0x10
[   81.130313][ T5635]  l2cap_chan_connect+0xff/0xf60
[   81.135296][ T5635]  ? reacquire_held_locks+0x117/0x1a0
[   81.140677][ T5635]  ? release_sock+0x2f/0x260
[   81.145273][ T5635]  ? __pfx_l2cap_chan_connect+0x10/0x10
[   81.150827][ T5635]  ? l2cap_sock_connect+0x15d/0x7e0
[   81.156254][ T5635]  ? bacmp+0xe/0x30
[   81.160074][ T5635]  l2cap_sock_connect+0x5e4/0x7e0
[   81.165111][ T5635]  ? __pfx_l2cap_sock_connect+0x10/0x10
[   81.170674][ T5635]  ? do_raw_spin_lock+0x12b/0x2f0
[   81.175728][ T5635]  ? kernel_connect+0xf1/0x1c0
[   81.180526][ T5635]  kernel_connect+0x141/0x1c0
[   81.185257][ T5635]  ? __pfx_kernel_connect+0x10/0x10
[   81.190488][ T5635]  ? rfcomm_dlc_open+0x608/0x1080
[   81.195526][ T5635]  rfcomm_dlc_open+0x644/0x1080
[   81.200491][ T5635]  ? reacquire_held_locks+0x117/0x1a0
[   81.205970][ T5635]  ? release_sock+0x2f/0x260
[   81.210923][ T5635]  ? __pfx_rfcomm_dlc_open+0x10/0x10
[   81.216670][ T5635]  ? rfcomm_sock_connect+0x2c6/0x650
[   81.222083][ T5635]  ? rfcomm_sock_connect+0x2c6/0x650
[   81.227475][ T5635]  ? __local_bh_enable_ip+0xd6/0x140
[   81.232784][ T5635]  rfcomm_sock_connect+0x2ed/0x650
[   81.238254][ T5635]  __sys_connect+0x316/0x450
[   81.242872][ T5635]  ? __pfx___sys_connect+0x10/0x10
[   81.248094][ T5635]  __x64_sys_connect+0x7a/0x90
[   81.252875][ T5635]  do_syscall_64+0x166/0x520
[   81.257501][ T5635]  ? trace_irq_disable+0x3b/0x140
[   81.262576][ T5635]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   81.268683][ T5635]  ? clear_bhb_loop+0x70/0xc0
[   81.273374][ T5635]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   81.279284][ T5635] RIP: 0033:0x7f523b1cabb9
[   81.283717][ T5635] Code: c0 79 93 eb d5 48 8d 7c 1d 00 eb 99 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 d0 ff ff ff f7 d8 64 89 01 48
[   81.303508][ T5635] RSP: 002b:00007ffc7b1a0138 EFLAGS: 00000246 ORIG_RAX: 000000000000002a
[   81.311939][ T5635] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007f523b1cabb9
[   81.320005][ T5635] RDX: 000000000000000a RSI: 00002000000003c0 RDI: 0000000000000004
[   81.328085][ T5635] RBP: 0000000000000003 R08: 0000000000000000 R09: 00007ffc7b1a0190
[   81.336079][ T5635] R10: 0000000000000000 R11: 0000000000000246 R12: 000055558ea923d0
[   81.344075][ T5635] R13: 0000000000000010 R14: 00007ffc7b1a01a0 R15: 00007f523b24717f
[   81.352081][ T5635]  </TASK>
[   82.399340][ T5630] Bluetooth: hci0: command tx timeout
[   84.479365][ T5630] Bluetooth: hci0: command 0x041b tx timeout
[pid  5635] connect(4, {sa_family=AF_BLUETOOTH, rc_bdaddr=ff:ff:ff:ff:ff:ff, rc_channel=8}, 10 <unfinished ...>
[pid  5629] kill(-3, SIGKILL <unfinished ...>
[pid  5635] <... connect resumed>)      = ?
[pid  5629] <... kill resumed>)         = 0
[pid  5629] kill(3, SIGKILL)            = 0
[pid  5635] +++ killed by SIGKILL +++
[pid  5629] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=3, si_uid=0, si_status=SIGKILL, si_utime=0, si_stime=0} ---
[pid  5629] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
[pid  5629] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci-upstream-rust-kasan-gce/strace-static-x86_64: Process 5642 attached
, child_tidptr=0x55558ea926d0) = 4
[pid  5629] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid  5642] set_robust_list(0x55558ea926e0, 24) = 0
[pid  5642] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid  5642] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5642] setpgid(0, 0)               = 0
[pid  5642] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5642] write(3, "1000", 4)         = 4
[pid  5642] close(3)                    = 0
[pid  5642] write(1, "executing program\n", 18) = 18
executing program
[pid  5642] write(202, "\x04\x06\x03\x00\xc9\x00", 6) = 6
[pid  5642] openat(AT_FDCWD, "/proc/self/ns/net", O_RDONLY) = 3
[pid  5642] setns(201, 0)               = 0
[pid  5642] socket(AF_BLUETOOTH, SOCK_STREAM, BTPROTO_RFCOMM) = 4
[pid  5642] setns(3, 0)                 = 0
[pid  5642] close(3)                    = 0
[   86.559336][ T5630] Bluetooth: hci0: command 0x041b tx timeout
[   86.959864][   T30] cfg80211: failed to load regulatory.db
[   88.639369][   T52] Bluetooth: hci0: command 0x041b tx timeout
[pid  5642] connect(4, {sa_family=AF_BLUETOOTH, rc_bdaddr=ff:ff:ff:ff:ff:ff, rc_channel=8}, 10 <unfinished ...>
[pid  5629] kill(-4, SIGKILL <unfinished ...>
[pid  5642] <... connect resumed>)      = ?
[pid  5629] <... kill resumed>)         = 0
[pid  5629] kill(4, SIGKILL)            = 0
[pid  5642] +++ killed by SIGKILL +++
[pid  5629] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=4, si_uid=0, si_status=SIGKILL, si_utime=0, si_stime=0} ---
[pid  5629] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
[pid  5629] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci-upstream-rust-kasan-gce/strace-static-x86_64: Process 5645 attached
, child_tidptr=0x55558ea926d0) = 5
[pid  5629] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  5645] set_robust_list(0x55558ea926e0, 24) = 0
[pid  5629] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  5645] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid  5645] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5645] setpgid(0, 0)               = 0
[pid  5645] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5645] write(3, "1000", 4)         = 4
[pid  5645] close(3)                    = 0
[pid  5645] write(1, "executing program\n", 18) = 18
executing program
[pid  5645] write(202, "\x04\x06\x03\x00\xc9\x00", 6) = 6
[pid  5645] openat(AT_FDCWD, "/proc/self/ns/net", O_RDONLY) = 3
[pid  5645] setns(201, 0)               = 0
[pid  5645] socket(AF_BLUETOOTH, SOCK_STREAM, BTPROTO_RFCOMM) = 4
[pid  5645] setns(3, 0)                 = 0
[pid  5645] close(3)                    = 0