./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor910566532 <...> Warning: Permanently added '10.128.1.74' (ED25519) to the list of known hosts. execve("./syz-executor910566532", ["./syz-executor910566532"], 0x7ffe5fbc62c0 /* 10 vars */) = 0 brk(NULL) = 0x555557451000 brk(0x555557451d40) = 0x555557451d40 arch_prctl(ARCH_SET_FS, 0x5555574513c0) = 0 set_tid_address(0x555557451690) = 5069 set_robust_list(0x5555574516a0, 24) = 0 rseq(0x555557451ce0, 0x20, 0, 0x53053053) = 0 prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 readlink("/proc/self/exe", "/root/syz-executor910566532", 4096) = 27 getrandom("\x8b\xe2\x90\x21\x01\x5e\xaf\x8a", 8, GRND_NONBLOCK) = 8 brk(NULL) = 0x555557451d40 brk(0x555557472d40) = 0x555557472d40 brk(0x555557473000) = 0x555557473000 mprotect(0x7f2005e51000, 16384, PROT_READ) = 0 mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000 mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000 mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000 unshare(CLONE_NEWPID) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555557451690) = 5070 ./strace-static-x86_64: Process 5070 attached [pid 5070] set_robust_list(0x5555574516a0, 24) = 0 [pid 5070] mount(NULL, "/sys/fs/fuse/connections", "fusectl", 0, NULL) = -1 EBUSY (Device or resource busy) [pid 5070] socket(AF_BLUETOOTH, SOCK_RAW, BTPROTO_HCI) = 3 [pid 5070] openat(AT_FDCWD, "/dev/vhci", O_RDWR) = 4 [pid 5070] dup2(4, 202) = 202 [pid 5070] close(4) = 0 [pid 5070] write(202, "\xff\x00", 2) = 2 [pid 5070] read(202, "\xff\x00\x00\x00", 4) = 4 [pid 5070] rt_sigaction(SIGRT_1, {sa_handler=0x7f2005df2d40, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f2005de43c0}, NULL, 8) = 0 [pid 5070] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 5070] mmap(NULL, 8392704, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f200558d000 [pid 5070] mprotect(0x7f200558e000, 8388608, PROT_READ|PROT_WRITE) = 0 [pid 5070] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5070] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f2005d8d990, parent_tid=0x7f2005d8d990, exit_signal=0, stack=0x7f200558d000, stack_size=0x800300, tls=0x7f2005d8d6c0}./strace-static-x86_64: Process 5073 attached => {parent_tid=[2]}, 88) = 2 [pid 5073] rseq(0x7f2005d8dfe0, 0x20, 0, 0x53053053 [pid 5070] rt_sigprocmask(SIG_SETMASK, [], [pid 5073] <... rseq resumed>) = 0 [pid 5070] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5073] set_robust_list(0x7f2005d8d9a0, 24 [pid 5070] ioctl(3, HCIDEVUP [pid 5073] <... set_robust_list resumed>) = 0 [pid 5073] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5073] read(202, "\x01\x03\x0c\x00", 1024) = 4 [pid 5073] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x0e\xfc", iov_len=2}, {iov_base="\x01\x03\x0c", iov_len=3}, {iov_base="\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., iov_len=249}], 4) = 255 [pid 5073] read(202, "\x01\x03\x10\x00", 1024) = 4 [pid 5073] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x0e\xfc", iov_len=2}, {iov_base="\x01\x03\x10", iov_len=3}, {iov_base="\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., iov_len=249}], 4) = 255 [pid 5073] read(202, "\x01\x01\x10\x00", 1024) = 4 [pid 5073] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x0e\xfc", iov_len=2}, {iov_base="\x01\x01\x10", iov_len=3}, {iov_base="\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., iov_len=249}], 4) = 255 [pid 5073] read(202, "\x01\x09\x10\x00", 1024) = 4 [pid 5073] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x0e\x0a", iov_len=2}, {iov_base="\x01\x09\x10", iov_len=3}, {iov_base="\x00\xaa\xaa\xaa\xaa\xaa\xaa", iov_len=7}], 4) = 13 [ 73.201415][ T50] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 73.220402][ T50] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 73.241630][ T50] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [pid 5073] read(202, "\x01\x05\x10\x00", 1024) = 4 [pid 5073] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x0e\x0b", iov_len=2}, {iov_base="\x01\x05\x10", iov_len=3}, {iov_base="\x00\xfd\x03\x60\x04\x00\x06\x00", iov_len=8}], 4) = 14 [pid 5073] read(202, "\x01\x23\x0c\x00", 1024) = 4 [pid 5073] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x0e\xfc", iov_len=2}, {iov_base="\x01\x23\x0c", iov_len=3}, {iov_base="\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., iov_len=249}], 4) = 255 [pid 5073] read(202, "\x01\x14\x0c\x00", 1024) = 4 [pid 5073] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x0e\xfc", iov_len=2}, {iov_base="\x01\x14\x0c", iov_len=3}, {iov_base="\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., iov_len=249}], 4) = 255 [pid 5073] read(202, "\x01\x25\x0c\x00", 1024) = 4 [pid 5073] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x0e\xfc", iov_len=2}, {iov_base="\x01\x25\x0c", iov_len=3}, {iov_base="\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., iov_len=249}], 4) = 255 [pid 5073] read(202, "\x01\x38\x0c\x00", 1024) = 4 [pid 5073] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x0e\xfc", iov_len=2}, {iov_base="\x01\x38\x0c", iov_len=3}, {iov_base="\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., iov_len=249}], 4) = 255 [pid 5073] read(202, "\x01\x39\x0c\x00", 1024) = 4 [pid 5073] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x0e\xfc", iov_len=2}, {iov_base="\x01\x39\x0c", iov_len=3}, {iov_base="\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., iov_len=249}], 4) = 255 [pid 5073] read(202, "\x01\x16\x0c\x02\x00\x7d", 1024) = 6 [pid 5073] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x0e\xfc", iov_len=2}, {iov_base="\x01\x16\x0c", iov_len=3}, {iov_base="\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., iov_len=249}], 4) = 255 [pid 5070] <... ioctl resumed>, 0) = -1 EALREADY (Operation already in progress) [pid 5073] read(202, [pid 5070] ioctl(3, HCISETSCAN [pid 5073] <... read resumed>"\x01\x1a\x0c\x01\x02", 1024) = 5 [pid 5073] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x0e\x04", iov_len=2}, {iov_base="\x01\x1a\x0c", iov_len=3}, {iov_base="\x00", iov_len=1}], 4) = 7 [pid 5073] rt_sigprocmask(SIG_BLOCK, ~[RT_1], [pid 5070] <... ioctl resumed>, 0x7ffecd502fec) = 0 [pid 5073] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5073] madvise(0x7f200558d000, 8372224, MADV_DONTNEED [pid 5070] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x04\x0a", iov_len=2}, {iov_base="\xaa\xaa\xaa\xaa\xaa\x10\x00\x00\x00\x01", iov_len=10}], 3 [pid 5073] <... madvise resumed>) = 0 [pid 5070] <... writev resumed>) = 13 [ 73.305481][ T50] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 73.315199][ T50] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 73.323675][ T50] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [pid 5073] exit(0 [pid 5070] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x03\x0b", iov_len=2}, {iov_base="\x00\xc8\x00\xaa\xaa\xaa\xaa\xaa\x10\x01\x00", iov_len=11}], 3 [pid 5073] <... exit resumed>) = ? [pid 5070] <... writev resumed>) = 14 [pid 5073] +++ exited with 0 +++ [pid 5070] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\v\v", iov_len=2}, {iov_base="\x00\xc8\x00\x00\x00\x00\x00\x00\x00\x00\x00", iov_len=11}], 3) = 14 [pid 5070] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x3e\x13", iov_len=2}, {iov_base="\x01\x00\xc9\x00\x01\x00\xaa\xaa\xaa\xaa\xaa\x11\x00\x00\x00\x00\x00\x00\x00", iov_len=19}], 3) = 22 [pid 5070] close(3) = 0 [pid 5070] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5070] setsid() = 1 [pid 5070] openat(AT_FDCWD, "/proc/self/ns/net", O_RDONLY) = 3 [pid 5070] dup2(3, 201) = 201 [pid 5070] close(3) = 0 [pid 5070] prlimit64(0, RLIMIT_AS, {rlim_cur=204800*1024, rlim_max=204800*1024}, NULL) = 0 [pid 5070] prlimit64(0, RLIMIT_MEMLOCK, {rlim_cur=32768*1024, rlim_max=32768*1024}, NULL) = 0 [pid 5070] prlimit64(0, RLIMIT_FSIZE, {rlim_cur=139264*1024, rlim_max=139264*1024}, NULL) = 0 [pid 5070] prlimit64(0, RLIMIT_STACK, {rlim_cur=1024*1024, rlim_max=1024*1024}, NULL) = 0 [pid 5070] prlimit64(0, RLIMIT_CORE, {rlim_cur=131072*1024, rlim_max=131072*1024}, NULL) = 0 [pid 5070] prlimit64(0, RLIMIT_NOFILE, {rlim_cur=256, rlim_max=256}, NULL) = 0 [pid 5070] unshare(CLONE_NEWNS) = 0 [pid 5070] mount(NULL, "/", NULL, MS_REC|MS_PRIVATE, NULL) = 0 [pid 5070] unshare(CLONE_NEWIPC) = 0 [pid 5070] unshare(CLONE_NEWCGROUP) = 0 [pid 5070] unshare(CLONE_NEWUTS) = 0 [pid 5070] unshare(CLONE_SYSVSEM) = 0 [pid 5070] openat(AT_FDCWD, "/proc/sys/kernel/shmmax", O_WRONLY|O_CLOEXEC) = 3 [pid 5070] write(3, "16777216", 8) = 8 [pid 5070] close(3) = 0 [pid 5070] openat(AT_FDCWD, "/proc/sys/kernel/shmall", O_WRONLY|O_CLOEXEC) = 3 [pid 5070] write(3, "536870912", 9) = 9 [pid 5070] close(3) = 0 [pid 5070] openat(AT_FDCWD, "/proc/sys/kernel/shmmni", O_WRONLY|O_CLOEXEC) = 3 [pid 5070] write(3, "1024", 4) = 4 [pid 5070] close(3) = 0 [pid 5070] openat(AT_FDCWD, "/proc/sys/kernel/msgmax", O_WRONLY|O_CLOEXEC) = 3 [pid 5070] write(3, "8192", 4) = 4 [pid 5070] close(3) = 0 [pid 5070] openat(AT_FDCWD, "/proc/sys/kernel/msgmni", O_WRONLY|O_CLOEXEC) = 3 [pid 5070] write(3, "1024", 4) = 4 [pid 5070] close(3) = 0 [pid 5070] openat(AT_FDCWD, "/proc/sys/kernel/msgmnb", O_WRONLY|O_CLOEXEC) = 3 [pid 5070] write(3, "1024", 4) = 4 [pid 5070] close(3) = 0 [pid 5070] openat(AT_FDCWD, "/proc/sys/kernel/sem", O_WRONLY|O_CLOEXEC) = 3 [pid 5070] write(3, "1024 1048576 500 1024", 21) = 21 [pid 5070] close(3) = 0 [pid 5070] getpid() = 1 [pid 5070] capget({version=_LINUX_CAPABILITY_VERSION_3, pid=1}, {effective=1< [pid 5070] kill(-3, SIGKILL) = 0 [pid 5070] kill(3, SIGKILL) = 0 [pid 5075] <... connect resumed>) = ? [pid 5075] +++ killed by SIGKILL +++ [pid 5070] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=3, si_uid=0, si_status=SIGKILL, si_utime=0, si_stime=0} --- [pid 5070] restart_syscall(<... resuming interrupted kill ...>) = 0 [pid 5070] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5076 attached , child_tidptr=0x555557451690) = 4 [pid 5076] set_robust_list(0x5555574516a0, 24) = 0 [pid 5076] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5076] setpgid(0, 0) = 0 [pid 5076] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5076] write(3, "1000", 4) = 4 [pid 5076] close(3) = 0 [pid 5076] openat(AT_FDCWD, "/proc/self/ns/net", O_RDONLY) = 3 [pid 5076] setns(201, 0) = 0 [pid 5076] socket(AF_BLUETOOTH, SOCK_STREAM, BTPROTO_RFCOMM) = 4 [pid 5076] setns(3, 0) = 0 [pid 5076] close(3) = 0 [ 79.546162][ T4467] Bluetooth: hci0: command 0x040f tx timeout [ 81.626186][ T4467] Bluetooth: hci0: command 0x0419 tx timeout [ 83.706162][ T4467] Bluetooth: hci0: command 0x0405 tx timeout [pid 5076] connect(4, {sa_family=AF_BLUETOOTH, rc_bdaddr=aa:aa:aa:aa:aa:00, rc_channel=1}, 10 [pid 5070] kill(-4, SIGKILL [pid 5076] <... connect resumed>) = ? [pid 5070] <... kill resumed>) = 0 [pid 5070] kill(4, SIGKILL) = 0 [pid 5076] +++ killed by SIGKILL +++ [pid 5070] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=4, si_uid=0, si_status=SIGKILL, si_utime=0, si_stime=0} --- [pid 5070] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5077 attached , child_tidptr=0x555557451690) = 5 [pid 5077] set_robust_list(0x5555574516a0, 24) = 0 [pid 5077] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5077] setpgid(0, 0) = 0 [pid 5077] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5077] write(3, "1000", 4) = 4 [pid 5077] close(3) = 0 [pid 5077] openat(AT_FDCWD, "/proc/self/ns/net", O_RDONLY) = 3 [pid 5077] setns(201, 0) = 0 [pid 5077] socket(AF_BLUETOOTH, SOCK_STREAM, BTPROTO_RFCOMM) = 4 [pid 5077] setns(3, 0) = 0 [pid 5077] close(3) = 0 [ 87.067996][ T23] cfg80211: failed to load regulatory.db [pid 5077] connect(4, {sa_family=AF_BLUETOOTH, rc_bdaddr=aa:aa:aa:aa:aa:00, rc_channel=1}, 10 [pid 5070] kill(-5, SIGKILL [pid 5077] <... connect resumed>) = ? [pid 5070] <... kill resumed>) = 0 [pid 5070] kill(5, SIGKILL) = 0 [pid 5077] +++ killed by SIGKILL +++ [pid 5070] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=5, si_uid=0, si_status=SIGKILL, si_utime=0, si_stime=0} --- [pid 5070] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5079 attached , child_tidptr=0x555557451690) = 6 [pid 5079] set_robust_list(0x5555574516a0, 24) = 0 [pid 5079] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5079] setpgid(0, 0) = 0 [pid 5079] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5079] write(3, "1000", 4) = 4 [pid 5079] close(3) = 0 [pid 5079] openat(AT_FDCWD, "/proc/self/ns/net", O_RDONLY) = 3 [pid 5079] setns(201, 0) = 0 [pid 5079] socket(AF_BLUETOOTH, SOCK_STREAM, BTPROTO_RFCOMM) = 4 [pid 5079] setns(3, 0) = 0 [pid 5079] close(3) = 0 [pid 5079] connect(4, {sa_family=AF_BLUETOOTH, rc_bdaddr=aa:aa:aa:aa:aa:00, rc_channel=1}, 10 [pid 5070] kill(-6, SIGKILL [pid 5079] <... connect resumed>) = ? [pid 5070] <... kill resumed>) = 0 [pid 5070] kill(6, SIGKILL) = 0 [pid 5079] +++ killed by SIGKILL +++ [pid 5070] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=6, si_uid=0, si_status=SIGKILL, si_utime=0, si_stime=0} --- [pid 5070] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555557451690) = 7 ./strace-static-x86_64: Process 5082 attached [pid 5082] set_robust_list(0x5555574516a0, 24) = 0 [pid 5082] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5082] setpgid(0, 0) = 0 [pid 5082] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5082] write(3, "1000", 4) = 4 [pid 5082] close(3) = 0 [pid 5082] openat(AT_FDCWD, "/proc/self/ns/net", O_RDONLY) = 3 [pid 5082] setns(201, 0) = 0 [pid 5082] socket(AF_BLUETOOTH, SOCK_STREAM, BTPROTO_RFCOMM) = 4 [pid 5082] setns(3, 0) = 0 [pid 5082] close(3) = 0 [pid 5082] connect(4, {sa_family=AF_BLUETOOTH, rc_bdaddr=aa:aa:aa:aa:aa:00, rc_channel=1}, 10 [pid 5070] kill(-7, SIGKILL [pid 5082] <... connect resumed>) = ? [pid 5070] <... kill resumed>) = 0 [pid 5070] kill(7, SIGKILL) = 0 [pid 5082] +++ killed by SIGKILL +++ [pid 5070] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=7, si_uid=0, si_status=SIGKILL, si_utime=0, si_stime=0} --- [pid 5070] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555557451690) = 8 ./strace-static-x86_64: Process 5084 attached [pid 5084] set_robust_list(0x5555574516a0, 24) = 0 [pid 5084] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5084] setpgid(0, 0) = 0 [pid 5084] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5084] write(3, "1000", 4) = 4 [pid 5084] close(3) = 0 [pid 5084] openat(AT_FDCWD, "/proc/self/ns/net", O_RDONLY) = 3 [pid 5084] setns(201, 0) = 0 [pid 5084] socket(AF_BLUETOOTH, SOCK_STREAM, BTPROTO_RFCOMM) = 4 [pid 5084] setns(3, 0) = 0 [pid 5084] close(3) = 0 [pid 5084] connect(4, {sa_family=AF_BLUETOOTH, rc_bdaddr=aa:aa:aa:aa:aa:00, rc_channel=1}, 10 [pid 5070] kill(-8, SIGKILL [pid 5084] <... connect resumed>) = ? [pid 5070] <... kill resumed>) = 0 [pid 5070] kill(8, SIGKILL) = 0 [pid 5084] +++ killed by SIGKILL +++ [pid 5070] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=8, si_uid=0, si_status=SIGKILL, si_utime=0, si_stime=0} --- [pid 5070] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555557451690) = 9 ./strace-static-x86_64: Process 5087 attached [pid 5087] set_robust_list(0x5555574516a0, 24) = 0 [pid 5087] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5087] setpgid(0, 0) = 0 [pid 5087] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5087] write(3, "1000", 4) = 4 [pid 5087] close(3) = 0 [pid 5087] openat(AT_FDCWD, "/proc/self/ns/net", O_RDONLY) = 3 [pid 5087] setns(201, 0) = 0 [pid 5087] socket(AF_BLUETOOTH, SOCK_STREAM, BTPROTO_RFCOMM) = 4 [pid 5087] setns(3, 0) = 0 [pid 5087] close(3) = 0 [pid 5087] connect(4, {sa_family=AF_BLUETOOTH, rc_bdaddr=aa:aa:aa:aa:aa:00, rc_channel=1}, 10 [pid 5070] kill(-9, SIGKILL [pid 5087] <... connect resumed>) = ? [pid 5070] <... kill resumed>) = 0 [pid 5070] kill(9, SIGKILL) = 0 [pid 5087] +++ killed by SIGKILL +++ [pid 5070] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=9, si_uid=0, si_status=SIGKILL, si_utime=0, si_stime=0} --- [pid 5070] restart_syscall(<... resuming interrupted kill ...>) = 0 [pid 5070] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5095 attached , child_tidptr=0x555557451690) = 10 [pid 5095] set_robust_list(0x5555574516a0, 24) = 0 [pid 5095] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5095] setpgid(0, 0) = 0 [pid 5095] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5095] write(3, "1000", 4) = 4 [pid 5095] close(3) = 0 [pid 5095] openat(AT_FDCWD, "/proc/self/ns/net", O_RDONLY) = 3 [pid 5095] setns(201, 0) = 0 [pid 5095] socket(AF_BLUETOOTH, SOCK_STREAM, BTPROTO_RFCOMM) = 4 [pid 5095] setns(3, 0) = 0 [pid 5095] close(3) = 0 [pid 5095] connect(4, {sa_family=AF_BLUETOOTH, rc_bdaddr=aa:aa:aa:aa:aa:00, rc_channel=1}, 10 [pid 5070] kill(-10, SIGKILL) = 0 [pid 5095] <... connect resumed>) = ? [pid 5070] kill(10, SIGKILL) = 0 [pid 5095] +++ killed by SIGKILL +++ [pid 5070] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=10, si_uid=0, si_status=SIGKILL, si_utime=0, si_stime=0} --- [pid 5070] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5098 attached , child_tidptr=0x555557451690) = 11 [pid 5098] set_robust_list(0x5555574516a0, 24) = 0 [pid 5098] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5098] setpgid(0, 0) = 0 [pid 5098] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5098] write(3, "1000", 4) = 4 [pid 5098] close(3) = 0 [pid 5098] openat(AT_FDCWD, "/proc/self/ns/net", O_RDONLY) = 3 [pid 5098] setns(201, 0) = 0 [pid 5098] socket(AF_BLUETOOTH, SOCK_STREAM, BTPROTO_RFCOMM) = 4 [pid 5098] setns(3, 0) = 0 [pid 5098] close(3) = 0 [ 116.026171][ T4467] Bluetooth: hci0: command 0x0405 tx timeout [pid 5098] connect(4, {sa_family=AF_BLUETOOTH, rc_bdaddr=aa:aa:aa:aa:aa:00, rc_channel=1}, 10 [pid 5070] kill(-11, SIGKILL [pid 5098] <... connect resumed>) = ? [pid 5070] <... kill resumed>) = 0 [pid 5098] +++ killed by SIGKILL +++ [pid 5070] kill(11, SIGKILL) = 0 [pid 5070] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=11, si_uid=0, si_status=SIGKILL, si_utime=0, si_stime=0} --- [pid 5070] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5100 attached [pid 5100] set_robust_list(0x5555574516a0, 24) = 0 [pid 5100] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5100] setpgid(0, 0) = 0 [pid 5100] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5070] <... clone resumed>, child_tidptr=0x555557451690) = 12 [pid 5100] <... openat resumed>) = 3 [pid 5100] write(3, "1000", 4) = 4 [pid 5100] close(3) = 0 [pid 5100] openat(AT_FDCWD, "/proc/self/ns/net", O_RDONLY) = 3 [pid 5100] setns(201, 0) = 0 [pid 5100] socket(AF_BLUETOOTH, SOCK_STREAM, BTPROTO_RFCOMM) = 4 [pid 5100] setns(3, 0) = 0 [pid 5100] close(3) = 0 [pid 5100] connect(4, {sa_family=AF_BLUETOOTH, rc_bdaddr=aa:aa:aa:aa:aa:00, rc_channel=1}, 10 [pid 5070] kill(-12, SIGKILL) = 0 [pid 5100] <... connect resumed>) = ? [pid 5070] kill(12, SIGKILL) = 0 [pid 5100] +++ killed by SIGKILL +++ [pid 5070] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=12, si_uid=0, si_status=SIGKILL, si_utime=0, si_stime=0} --- [pid 5070] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5102 attached , child_tidptr=0x555557451690) = 13 [pid 5102] set_robust_list(0x5555574516a0, 24) = 0 [pid 5102] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5102] setpgid(0, 0) = 0 [pid 5102] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5102] write(3, "1000", 4) = 4 [pid 5102] close(3) = 0 [pid 5102] openat(AT_FDCWD, "/proc/self/ns/net", O_RDONLY) = 3 [pid 5102] setns(201, 0) = 0 [pid 5102] socket(AF_BLUETOOTH, SOCK_STREAM, BTPROTO_RFCOMM) = 4 [pid 5102] setns(3, 0) = 0 [pid 5102] close(3) = 0 [pid 5102] connect(4, {sa_family=AF_BLUETOOTH, rc_bdaddr=aa:aa:aa:aa:aa:00, rc_channel=1}, 10 [pid 5070] kill(-13, SIGKILL [pid 5102] <... connect resumed>) = ? [pid 5070] <... kill resumed>) = 0 [pid 5070] kill(13, SIGKILL [pid 5102] +++ killed by SIGKILL +++ [pid 5070] <... kill resumed>) = 0 [pid 5070] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=13, si_uid=0, si_status=SIGKILL, si_utime=0, si_stime=0} --- [pid 5070] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5103 attached [pid 5103] set_robust_list(0x5555574516a0, 24) = 0 [pid 5103] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5070] <... clone resumed>, child_tidptr=0x555557451690) = 14 [pid 5103] <... prctl resumed>) = 0 [pid 5103] setpgid(0, 0) = 0 [pid 5103] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5103] write(3, "1000", 4) = 4 [pid 5103] close(3) = 0 [pid 5103] openat(AT_FDCWD, "/proc/self/ns/net", O_RDONLY) = 3 [pid 5103] setns(201, 0) = 0 [pid 5103] socket(AF_BLUETOOTH, SOCK_STREAM, BTPROTO_RFCOMM) = 4 [pid 5103] setns(3, 0) = 0 [pid 5103] close(3) = 0 [pid 5103] connect(4, {sa_family=AF_BLUETOOTH, rc_bdaddr=aa:aa:aa:aa:aa:00, rc_channel=1}, 10 [pid 5070] kill(-14, SIGKILL) = 0 [pid 5103] <... connect resumed>) = ? [pid 5070] kill(14, SIGKILL) = 0 [pid 5103] +++ killed by SIGKILL +++ [pid 5070] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=14, si_uid=0, si_status=SIGKILL, si_utime=0, si_stime=0} --- [pid 5070] restart_syscall(<... resuming interrupted kill ...>) = 0 [pid 5070] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5104 attached , child_tidptr=0x555557451690) = 15 [pid 5104] set_robust_list(0x5555574516a0, 24) = 0 [pid 5104] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5104] setpgid(0, 0) = 0 [pid 5104] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5104] write(3, "1000", 4) = 4 [pid 5104] close(3) = 0 [pid 5104] openat(AT_FDCWD, "/proc/self/ns/net", O_RDONLY) = 3 [pid 5104] setns(201, 0) = 0 [pid 5104] socket(AF_BLUETOOTH, SOCK_STREAM, BTPROTO_RFCOMM) = 4 [pid 5104] setns(3, 0) = 0 [pid 5104] close(3) = 0 [pid 5104] connect(4, {sa_family=AF_BLUETOOTH, rc_bdaddr=aa:aa:aa:aa:aa:00, rc_channel=1}, 10 [pid 5070] kill(-15, SIGKILL [pid 5104] <... connect resumed>) = ? [pid 5070] <... kill resumed>) = 0 [pid 5070] kill(15, SIGKILL [pid 5104] +++ killed by SIGKILL +++ [pid 5070] <... kill resumed>) = 0 [pid 5070] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=15, si_uid=0, si_status=SIGKILL, si_utime=0, si_stime=0} --- [pid 5070] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5105 attached [pid 5105] set_robust_list(0x5555574516a0, 24) = 0 [pid 5070] <... clone resumed>, child_tidptr=0x555557451690) = 16 [pid 5105] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5105] setpgid(0, 0) = 0 [pid 5105] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5105] write(3, "1000", 4) = 4 [pid 5105] close(3) = 0 [pid 5105] openat(AT_FDCWD, "/proc/self/ns/net", O_RDONLY) = 3 [pid 5105] setns(201, 0) = 0 [pid 5105] socket(AF_BLUETOOTH, SOCK_STREAM, BTPROTO_RFCOMM) = 4 [pid 5105] setns(3, 0) = 0 [pid 5105] close(3) = 0 [pid 5105] connect(4, {sa_family=AF_BLUETOOTH, rc_bdaddr=aa:aa:aa:aa:aa:00, rc_channel=1}, 10 [pid 5070] kill(-16, SIGKILL [pid 5105] <... connect resumed>) = ? [pid 5070] <... kill resumed>) = 0 [pid 5070] kill(16, SIGKILL) = 0 [pid 5105] +++ killed by SIGKILL +++ [pid 5070] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=16, si_uid=0, si_status=SIGKILL, si_utime=0, si_stime=0} --- [pid 5070] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555557451690) = 17 ./strace-static-x86_64: Process 5106 attached [pid 5106] set_robust_list(0x5555574516a0, 24) = 0 [pid 5106] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5106] setpgid(0, 0) = 0 [pid 5106] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5106] write(3, "1000", 4) = 4 [pid 5106] close(3) = 0 [pid 5106] openat(AT_FDCWD, "/proc/self/ns/net", O_RDONLY) = 3 [pid 5106] setns(201, 0) = 0 [pid 5106] socket(AF_BLUETOOTH, SOCK_STREAM, BTPROTO_RFCOMM) = 4 [pid 5106] setns(3, 0) = 0 [pid 5106] close(3) = 0 [pid 5106] connect(4, {sa_family=AF_BLUETOOTH, rc_bdaddr=aa:aa:aa:aa:aa:00, rc_channel=1}, 10 [pid 5070] kill(-17, SIGKILL) = 0 [pid 5106] <... connect resumed>) = ? [pid 5070] kill(17, SIGKILL) = 0 [pid 5106] +++ killed by SIGKILL +++ [pid 5070] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=17, si_uid=0, si_status=SIGKILL, si_utime=0, si_stime=0} --- [pid 5070] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555557451690) = 18 ./strace-static-x86_64: Process 5107 attached [pid 5107] set_robust_list(0x5555574516a0, 24) = 0 [pid 5107] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5107] setpgid(0, 0) = 0 [pid 5107] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5107] write(3, "1000", 4) = 4 [pid 5107] close(3) = 0 [pid 5107] openat(AT_FDCWD, "/proc/self/ns/net", O_RDONLY) = 3 [pid 5107] setns(201, 0) = 0 [pid 5107] socket(AF_BLUETOOTH, SOCK_STREAM, BTPROTO_RFCOMM) = 4 [pid 5107] setns(3, 0) = 0 [pid 5107] close(3) = 0 [pid 5107] connect(4, {sa_family=AF_BLUETOOTH, rc_bdaddr=aa:aa:aa:aa:aa:00, rc_channel=1}, 10 [pid 5070] kill(-18, SIGKILL) = 0 [pid 5107] <... connect resumed>) = ? [pid 5070] kill(18, SIGKILL) = 0 [pid 5107] +++ killed by SIGKILL +++ [pid 5070] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=18, si_uid=0, si_status=SIGKILL, si_utime=0, si_stime=0} --- [pid 5070] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5108 attached [pid 5108] set_robust_list(0x5555574516a0, 24) = 0 [pid 5108] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5070] <... clone resumed>, child_tidptr=0x555557451690) = 19 [pid 5108] <... prctl resumed>) = 0 [pid 5108] setpgid(0, 0) = 0 [pid 5108] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5108] write(3, "1000", 4) = 4 [pid 5108] close(3) = 0 [pid 5108] openat(AT_FDCWD, "/proc/self/ns/net", O_RDONLY) = 3 [pid 5108] setns(201, 0) = 0 [pid 5108] socket(AF_BLUETOOTH, SOCK_STREAM, BTPROTO_RFCOMM) = 4 [pid 5108] setns(3, 0) = 0 [pid 5108] close(3) = 0 [pid 5108] connect(4, {sa_family=AF_BLUETOOTH, rc_bdaddr=aa:aa:aa:aa:aa:00, rc_channel=1}, 10) = -1 ECONNREFUSED (Connection refused) [pid 5108] getsockopt(-1, SOL_IPV6, IPV6_FLOWLABEL_MGR, 0x20000100, NULL) = -1 EBADF (Bad file descriptor) [pid 5108] openat(AT_FDCWD, "/proc/self/ns/net", O_RDONLY) = 3 [pid 5108] setns(201, 0) = 0 [pid 5108] socket(AF_BLUETOOTH, SOCK_RAW, BTPROTO_RFCOMM) = 5 [pid 5108] setns(3, 0) = 0 [pid 5108] close(3) = 0 [ 154.292659][ T5108] [ 154.295014][ T5108] ====================================================== [ 154.302014][ T5108] WARNING: possible circular locking dependency detected [ 154.309015][ T5108] 6.6.0-syzkaller-15859-g89cdf9d55601 #0 Not tainted [ 154.315663][ T5108] ------------------------------------------------------ [ 154.322661][ T5108] syz-executor910/5108 is trying to acquire lock: [ 154.329050][ T5108] ffffffff8ed39b08 (rfcomm_mutex){+.+.}-{3:3}, at: rfcomm_dlc_exists+0x5b/0x190 [ 154.338159][ T5108] [ 154.338159][ T5108] but task is already holding lock: [ 154.345514][ T5108] ffffffff8ed3ea88 (rfcomm_ioctl_mutex){+.+.}-{3:3}, at: rfcomm_dev_ioctl+0x8b9/0x1c50 [ 154.355160][ T5108] [ 154.355160][ T5108] which lock already depends on the new lock. [ 154.355160][ T5108] [ 154.365546][ T5108] [ 154.365546][ T5108] the existing dependency chain (in reverse order) is: [ 154.374544][ T5108] [ 154.374544][ T5108] -> #3 (rfcomm_ioctl_mutex){+.+.}-{3:3}: [ 154.382431][ T5108] __mutex_lock+0x175/0x9d0 [ 154.387449][ T5108] rfcomm_dev_ioctl+0x8b9/0x1c50 [ 154.392910][ T5108] rfcomm_sock_ioctl+0xb0/0xe0 [ 154.398185][ T5108] sock_do_ioctl+0x113/0x270 [ 154.403289][ T5108] sock_ioctl+0x22e/0x6b0 [ 154.408131][ T5108] __x64_sys_ioctl+0x18f/0x210 [ 154.413412][ T5108] do_syscall_64+0x40/0x110 [ 154.418454][ T5108] entry_SYSCALL_64_after_hwframe+0x63/0x6b [ 154.424903][ T5108] [ 154.424903][ T5108] -> #2 (sk_lock-AF_BLUETOOTH-BTPROTO_RFCOMM){+.+.}-{0:0}: [ 154.434299][ T5108] lock_sock_nested+0x3a/0xf0 [ 154.439494][ T5108] rfcomm_sk_state_change+0x6d/0x3a0 [ 154.445301][ T5108] __rfcomm_dlc_close+0x285/0x720 [ 154.450829][ T5108] rfcomm_dlc_close+0x1e7/0x240 [ 154.456207][ T5108] __rfcomm_sock_close+0xa7/0x230 [ 154.461738][ T5108] rfcomm_sock_shutdown+0xd1/0x230 [ 154.467360][ T5108] rfcomm_sock_release+0x5d/0x140 [ 154.472933][ T5108] __sock_release+0xae/0x260 [ 154.478204][ T5108] sock_close+0x1c/0x20 [ 154.482863][ T5108] __fput+0x270/0xbb0 [ 154.487353][ T5108] task_work_run+0x14d/0x240 [ 154.492447][ T5108] do_exit+0xa92/0x2ae0 [ 154.497115][ T5108] do_group_exit+0xd4/0x2a0 [ 154.502133][ T5108] get_signal+0x23be/0x2790 [ 154.507147][ T5108] arch_do_signal_or_restart+0x90/0x7f0 [ 154.513208][ T5108] exit_to_user_mode_prepare+0x121/0x240 [ 154.519374][ T5108] syscall_exit_to_user_mode+0x1e/0x60 [ 154.525352][ T5108] do_syscall_64+0x4d/0x110 [ 154.530371][ T5108] entry_SYSCALL_64_after_hwframe+0x63/0x6b [ 154.536795][ T5108] [ 154.536795][ T5108] -> #1 (&d->lock){+.+.}-{3:3}: [ 154.543810][ T5108] __mutex_lock+0x175/0x9d0 [ 154.548827][ T5108] __rfcomm_dlc_close+0x231/0x720 [ 154.554355][ T5108] rfcomm_dlc_close+0x1e7/0x240 [ 154.559708][ T5108] __rfcomm_sock_close+0xa7/0x230 [ 154.565233][ T5108] rfcomm_sock_shutdown+0xd1/0x230 [ 154.570847][ T5108] rfcomm_sock_release+0x5d/0x140 [ 154.576379][ T5108] __sock_release+0xae/0x260 [ 154.581479][ T5108] sock_close+0x1c/0x20 [ 154.586142][ T5108] __fput+0x270/0xbb0 [ 154.590628][ T5108] task_work_run+0x14d/0x240 [ 154.595719][ T5108] do_exit+0xa92/0x2ae0 [ 154.600381][ T5108] do_group_exit+0xd4/0x2a0 [ 154.605392][ T5108] get_signal+0x23be/0x2790 [ 154.610428][ T5108] arch_do_signal_or_restart+0x90/0x7f0 [ 154.616504][ T5108] exit_to_user_mode_prepare+0x121/0x240 [ 154.622646][ T5108] syscall_exit_to_user_mode+0x1e/0x60 [ 154.628720][ T5108] do_syscall_64+0x4d/0x110 [ 154.633731][ T5108] entry_SYSCALL_64_after_hwframe+0x63/0x6b [ 154.640138][ T5108] [ 154.640138][ T5108] -> #0 (rfcomm_mutex){+.+.}-{3:3}: [ 154.647517][ T5108] __lock_acquire+0x2464/0x3b10 [ 154.652906][ T5108] lock_acquire+0x1ae/0x520 [ 154.657931][ T5108] __mutex_lock+0x175/0x9d0 [ 154.662955][ T5108] rfcomm_dlc_exists+0x5b/0x190 [ 154.668314][ T5108] rfcomm_dev_ioctl+0x999/0x1c50 [ 154.673760][ T5108] rfcomm_sock_ioctl+0xb0/0xe0 [ 154.679031][ T5108] sock_do_ioctl+0x113/0x270 [ 154.684126][ T5108] sock_ioctl+0x22e/0x6b0 [ 154.688964][ T5108] __x64_sys_ioctl+0x18f/0x210 [ 154.694238][ T5108] do_syscall_64+0x40/0x110 [ 154.699246][ T5108] entry_SYSCALL_64_after_hwframe+0x63/0x6b [ 154.705650][ T5108] [ 154.705650][ T5108] other info that might help us debug this: [ 154.705650][ T5108] [ 154.715870][ T5108] Chain exists of: [ 154.715870][ T5108] rfcomm_mutex --> sk_lock-AF_BLUETOOTH-BTPROTO_RFCOMM --> rfcomm_ioctl_mutex [ 154.715870][ T5108] [ 154.730622][ T5108] Possible unsafe locking scenario: [ 154.730622][ T5108] [ 154.738052][ T5108] CPU0 CPU1 [ 154.743398][ T5108] ---- ---- [ 154.748746][ T5108] lock(rfcomm_ioctl_mutex); [ 154.753405][ T5108] lock(sk_lock-AF_BLUETOOTH-BTPROTO_RFCOMM); [ 154.762059][ T5108] lock(rfcomm_ioctl_mutex); [ 154.769253][ T5108] lock(rfcomm_mutex); [ 154.773390][ T5108] [ 154.773390][ T5108] *** DEADLOCK *** [ 154.773390][ T5108] [ 154.781515][ T5108] 2 locks held by syz-executor910/5108: [ 154.787038][ T5108] #0: ffff88807ca89130 (sk_lock-AF_BLUETOOTH-BTPROTO_RFCOMM){+.+.}-{0:0}, at: rfcomm_sock_ioctl+0xa3/0xe0 [ 154.798416][ T5108] #1: ffffffff8ed3ea88 (rfcomm_ioctl_mutex){+.+.}-{3:3}, at: rfcomm_dev_ioctl+0x8b9/0x1c50 [ 154.808495][ T5108] [ 154.808495][ T5108] stack backtrace: [ 154.814363][ T5108] CPU: 0 PID: 5108 Comm: syz-executor910 Not tainted 6.6.0-syzkaller-15859-g89cdf9d55601 #0 [ 154.824409][ T5108] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/10/2023 [ 154.834446][ T5108] Call Trace: [ 154.837714][ T5108] [ 154.840626][ T5108] dump_stack_lvl+0xd9/0x1b0 [ 154.845202][ T5108] check_noncircular+0x317/0x400 [ 154.850136][ T5108] ? print_circular_bug+0x5c0/0x5c0 [ 154.855347][ T5108] ? __kernel_text_address+0xd/0x30 [ 154.860542][ T5108] ? unwind_get_return_address+0x45/0xe0 [ 154.866161][ T5108] ? lockdep_lock+0xc6/0x200 [ 154.870739][ T5108] ? hlock_class+0x130/0x130 [ 154.875315][ T5108] __lock_acquire+0x2464/0x3b10 [ 154.880159][ T5108] ? lockdep_hardirqs_on_prepare+0x420/0x420 [ 154.886130][ T5108] ? add_lock_to_list+0x17d/0x380 [ 154.891580][ T5108] lock_acquire+0x1ae/0x520 [ 154.896083][ T5108] ? rfcomm_dlc_exists+0x5b/0x190 [ 154.901091][ T5108] ? lock_sync+0x190/0x190 [ 154.905614][ T5108] ? __mutex_trylock_common+0xeb/0x250 [ 154.911080][ T5108] ? preempt_count_sub+0x160/0x160 [ 154.916173][ T5108] ? mutex_is_locked+0x40/0x40 [ 154.920922][ T5108] __mutex_lock+0x175/0x9d0 [ 154.925416][ T5108] ? rfcomm_dlc_exists+0x5b/0x190 [ 154.930423][ T5108] ? aa_get_newest_label+0x376/0x680 [ 154.935696][ T5108] ? rfcomm_dlc_exists+0x5b/0x190 [ 154.940702][ T5108] ? mutex_trylock+0x130/0x130 [ 154.945451][ T5108] ? reacquire_held_locks+0x4c0/0x4c0 [ 154.950827][ T5108] ? apparmor_capable+0x126/0x1e0 [ 154.955856][ T5108] ? rfcomm_dlc_exists+0x5b/0x190 [ 154.960862][ T5108] rfcomm_dlc_exists+0x5b/0x190 [ 154.965711][ T5108] rfcomm_dev_ioctl+0x999/0x1c50 [ 154.970637][ T5108] ? rfcomm_dev_state_change+0x170/0x170 [ 154.976254][ T5108] ? reacquire_held_locks+0x4c0/0x4c0 [ 154.981615][ T5108] ? mark_held_locks+0x9f/0xe0 [ 154.986368][ T5108] ? __local_bh_enable_ip+0xa4/0x120 [ 154.991636][ T5108] rfcomm_sock_ioctl+0xb0/0xe0 [ 154.996386][ T5108] sock_do_ioctl+0x113/0x270 [ 155.000967][ T5108] ? put_user_ifreq+0x140/0x140 [ 155.005803][ T5108] ? do_vfs_ioctl+0x379/0x1920 [ 155.010571][ T5108] ? vfs_fileattr_set+0xbf0/0xbf0 [ 155.015589][ T5108] sock_ioctl+0x22e/0x6b0 [ 155.019908][ T5108] ? br_ioctl_call+0xb0/0xb0 [ 155.024482][ T5108] ? restore_fpregs_from_fpstate+0xc1/0x1d0 [ 155.030375][ T5108] ? bpf_lsm_file_ioctl+0x9/0x10 [ 155.035314][ T5108] ? br_ioctl_call+0xb0/0xb0 [ 155.039900][ T5108] __x64_sys_ioctl+0x18f/0x210 [ 155.044660][ T5108] do_syscall_64+0x40/0x110 [ 155.049159][ T5108] entry_SYSCALL_64_after_hwframe+0x63/0x6b [ 155.055057][ T5108] RIP: 0033:0x7f2005dccd49 [ 155.059488][ T5108] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 11 19 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 [ 155.079088][ T5108] RSP: 002b:00007ffecd502fb8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 155.087486][ T5108] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007f2005dccd49 [pid 5108] ioctl(5, RFCOMMCREATEDEV, 0x20000100) = -1 ENFILE (Too many open files in system) [pid 5108] close(3) = -1 EBADF (Bad file descriptor) [pid 5108] close(4) = 0 [pid 5108] close(5) = 0 [pid 5108] close(6) = -1 EBADF (Bad file descriptor) [pid 5108] close(7) = -1 EBADF (Bad file descriptor) [pid 5108] close(8) = -1 EBADF (Bad file descriptor) [pid 5108] close(9) = -1 EBADF (Bad file descriptor) [pid 5108] close(10) = -1 EBADF (Bad file descriptor) [pid 5108] close(11) = -1 EBADF (Bad file descriptor) [pid 5108] close(12) = -1 EBADF (Bad file descriptor) [pid 5108] close(13) = -1 EBADF (Bad file descriptor) [pid 5108] close(14) = -1 EBADF (Bad file descriptor) [pid 5108] close(15) = -1 EBADF (Bad file descriptor) [pid 5108] close(16) = -1 EBADF (Bad file descriptor) [pid 5108] close(17) = -1 EBADF (Bad file descriptor) [pid 5108] close(18) = -1 EBADF (Bad file descriptor) [pid 5108] close(19) = -1 EBADF (Bad file descriptor) [ 155.095445][ T5108] RDX: 0000000020000100 RSI: 00000000400452c8 RDI: 0000000000000005 [ 155.103404][ T5108] RBP: 00000000000f4240 R08: 0000000000000000 R09: 0000555500000000 [ 155.111360][ T5108] R10: 0000555500000000 R11: 0000000000000246 R12: 00007ffecd503000 [ 155.119328][ T5108] R13: 00007ffecd503010 R14: 000000000002469a R15: 00007ffecd502fd0 [ 155.127292][ T5108] [pid 5108] close(20) = -1 EBADF (Bad file descriptor) [pid 5108] close(21) = -1 EBADF (Bad file descriptor) [pid 5108] close(22) = -1 EBADF (Bad file descriptor) [pid 5108] close(23) = -1 EBADF (Bad file descriptor) [pid 5108] close(24) = -1 EBADF (Bad file descriptor) [pid 5108] close(25) = -1 EBADF (Bad file descriptor) [pid 5108] close(26) = -1 EBADF (Bad file descriptor) [pid 5108] close(27) = -1 EBADF (Bad file descriptor) [pid 5108] close(28) = -1 EBADF (Bad file descriptor) [pid 5108] close(29) = -1 EBADF (Bad file descriptor) [pid 5108] exit_group(0) = ? [pid 5108] +++ exited with 0 +++ [pid 5070] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=19, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- [pid 5070] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5109 attached , child_tidptr=0x555557451690) = 20 [pid 5109] set_robust_list(0x5555574516a0, 24) = 0 [pid 5109] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5109] setpgid(0, 0) = 0 [pid 5109] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5109] write(3, "1000", 4) = 4 [pid 5109] close(3) = 0 [pid 5109] openat(AT_FDCWD, "/proc/self/ns/net", O_RDONLY) = 3 [pid 5109] setns(201, 0) = 0 [pid 5109] socket(AF_BLUETOOTH, SOCK_STREAM, BTPROTO_RFCOMM) = 4 [pid 5109] setns(3, 0) = 0 [pid 5109] close(3) = 0 [ 157.306151][ T4467] Bluetooth: hci0: command 0x0405 tx timeout [pid 5109] connect(4, {sa_family=AF_BLUETOOTH, rc_bdaddr=aa:aa:aa:aa:aa:00, rc_channel=1}, 10 [pid 5070] kill(-20, SIGKILL) = 0 [pid 5109] <... connect resumed>) = ? [pid 5109] +++ killed by SIGKILL +++ [pid 5070] kill(20, SIGKILL) = 0 [pid 5070] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=20, si_uid=0, si_status=SIGKILL, si_utime=0, si_stime=0} --- [pid 5070] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5110 attached [pid 5110] set_robust_list(0x5555574516a0, 24) = 0 [pid 5110] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5110] setpgid(0, 0) = 0 [pid 5070] <... clone resumed>, child_tidptr=0x555557451690) = 21 [pid 5110] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5110] write(3, "1000", 4) = 4 [pid 5110] close(3) = 0 [pid 5110] openat(AT_FDCWD, "/proc/self/ns/net", O_RDONLY) = 3 [pid 5110] setns(201, 0) = 0 [pid 5110] socket(AF_BLUETOOTH, SOCK_STREAM, BTPROTO_RFCOMM) = 4 [pid 5110] setns(3, 0) = 0 [pid 5110] close(3) = 0