Extracting prog: 35m22.416128424s
Minimizing prog: 9m55.702506499s
Simplifying prog options: 0s
Extracting C: 29.940359182s
Simplifying C: 18m35.069610418s


extracting reproducer from 24 programs
testing a last program of every proc
single: executing 4 programs separately with timeout 30s
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$packet-ioctl$sock_SIOCGIFINDEX-mkdirat-mount-openat-write-socket$nl_route-sendmsg$nl_route-sendto$packet
detailed listing:
executing program 0:
r0 = socket$packet(0x11, 0x3, 0x300)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'bridge_slave_0\x00', <r1=>0x0})
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='sys\x00', &(0x7f0000000140)='sysfs\x00', 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000180)='sys/class/net/bridge_slave_0/brport/multicast_to_unicast\x00', 0x1, 0x0)
write(r2, &(0x7f0000000200)='1', 0x1)
r3 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000380)=ANY=[@ANYBLOB="3800000054000106010000000000000007000000", @ANYRES32, @ANYBLOB="20000100", @ANYRES32=r1, @ANYBLOB="0100000001005e01010100"/24], 0x38}}, 0x0)
sendto$packet(r0, &(0x7f0000000500)="01005e0101010011223344558888aabbccdd", 0x12, 0x0, &(0x7f0000000600)={0x11, 0x8888, 0x0, 0x1, 0x0, 0x6, @random}, 0x14)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route
detailed listing:
executing program 0:
r0 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'batadv0\x00'})
sendmsg$nl_route(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=@dellink={0x20, 0x11, 0x5}, 0x20}}, 0x0)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$bt_bnep-syz_init_net_socket$bt_l2cap-bind$bt_l2cap-ioctl$sock_bt_bnep_BNEPCONNADD-syz_emit_vhci-nanosleep
detailed listing:
executing program 0:
r0 = syz_init_net_socket$bt_bnep(0x1f, 0x3, 0x4)
r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0)
bind$bt_l2cap(r1, &(0x7f0000000100)={0x1f, 0x0, @any, 0x40}, 0xe)
ioctl$sock_bt_bnep_BNEPCONNADD(r0, 0x400442c8, &(0x7f0000000300)={r1, 0x0, 0x0, 'bnep0\x00'})
syz_emit_vhci(&(0x7f0000000400)=ANY=[@ANYBLOB="02c82008000400400001030000"], 0xd)
nanosleep(&(0x7f0000000500)={0x0, 0x1dcd6500}, 0x0)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$bt_hci-bind$bt_hci-write-nanosleep-write-nanosleep
detailed listing:
executing program 0:
r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffff, 0x3}, 0x6)
write(r0, &(0x7f0000000100)="060000000300010000", 0x9)
nanosleep(&(0x7f0000000200)={0x3}, 0x0)
write(r0, &(0x7f0000000300)="060000000300000000", 0x9)
nanosleep(&(0x7f0000000400)={0x1}, 0x0)

program did not crash
single: failed to extract reproducer
bisect: bisecting 24 programs with base timeout 30s
testing program (duration=36s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [9, 2, 6, 9, 6, 4, 4, 11, 2, 6, 6, 9, 5, 7, 8, 2, 3, 6, 6, 5, 6, 6, 3, 9]
detailed listing:
executing program 3:
syz_emit_vhci(&(0x7f0000000040)=@HCI_EVENT_PKT={0x4, @hci_ev_cmd_status={{0xf, 0x4}, {0x1, 0xfa, 0x41b}}}, 0x7)
r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffff, 0x3}, 0x6)
write(r0, &(0x7f0000000100)="05000000010000", 0x7)
nanosleep(&(0x7f0000000200)={0x0, 0x1dcd6500}, 0x0)
write(r0, &(0x7f0000000100)="05000000010001", 0x7)
nanosleep(&(0x7f0000000200)={0x0, 0x1dcd6500}, 0x0)
write(r0, &(0x7f0000000100)="05000000010000", 0x7)
nanosleep(&(0x7f0000000200)={0x0, 0x1dcd6500}, 0x0)
executing program 0:
r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
ioctl$sock_bt_hci(r0, 0x800448d2, &(0x7f0000000040)='\x00'/16)
executing program 0:
r0 = socket$packet(0x11, 0x3, 0x300)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge0\x00', <r1=>0x0})
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'bridge_slave_0\x00'})
r2 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r2, 0x0, 0x0)
sendto$packet(r0, &(0x7f0000000500)="01005e0101010011223344558888aabbccdd", 0x12, 0x0, &(0x7f0000000600)={0x11, 0x8888, r1, 0x1, 0x0, 0x6, @random="01005e010101"}, 0x14)
executing program 0:
r0 = socket$packet(0x11, 0x3, 0x300)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'bridge_slave_0\x00', <r1=>0x0})
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='sys\x00', &(0x7f0000000140)='sysfs\x00', 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000180)='sys/class/net/bridge_slave_0/brport/multicast_to_unicast\x00', 0x1, 0x0)
write(r2, &(0x7f0000000200)='1', 0x1)
r3 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000380)=ANY=[@ANYBLOB="3800000054000106010000000000000007000000", @ANYRES32, @ANYBLOB="20000100", @ANYRES32=r1, @ANYBLOB="0100000001005e01010100"/24], 0x38}}, 0x0)
sendto$packet(r0, &(0x7f0000000500)="01005e0101010011223344558888aabbccdd", 0x12, 0x0, &(0x7f0000000600)={0x11, 0x8888, 0x0, 0x1, 0x0, 0x6, @random}, 0x14)
executing program 3:
r0 = syz_init_net_socket$bt_bnep(0x1f, 0x3, 0x4)
r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0)
bind$bt_l2cap(r1, &(0x7f0000000100)={0x1f, 0x0, @any, 0x40}, 0xe)
ioctl$sock_bt_bnep_BNEPCONNADD(r0, 0x400442c8, &(0x7f0000000300)={r1, 0x0, 0x0, 'bnep0\x00'})
syz_emit_vhci(&(0x7f0000000400)=ANY=[@ANYBLOB="02c82008000400400001030000"], 0xd)
nanosleep(&(0x7f0000000500)={0x0, 0x1dcd6500}, 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/class/net/bridge_slave_0/brport/multicast_router\x00', 0x2, 0x0)
write(r0, &(0x7f0000000200), 0x0)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/class/net/bridge_slave_0/brport/neigh_suppress\x00', 0x0, 0x0)
read(r0, &(0x7f0000000200)=""/16, 0x10)
executing program 0:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
bind$inet(r0, &(0x7f0000000000)={0x2, 0x1a85, @empty}, 0x10)
listen(r0, 0x5)
r1 = syz_io_uring_setup(0x10, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f0000000100)=<r2=>0x0, &(0x7f0000000000)=<r3=>0x0, 0x0)
syz_io_uring_submit(r2, r3, 0x0, &(0x7f0000000280)=@IORING_OP_ACCEPT={0xd, 0x0, 0x0, r0, &(0x7f0000000500), &(0x7f0000000600)=@in={0x2, 0x0, @empty}})
io_uring_enter(r1, 0x1, 0x0, 0x0, 0x0, 0x0)
r4 = fsopen(&(0x7f0000000100)='ceph\x00', 0x0)
fsconfig$FSCONFIG_SET_STRING(r4, 0x1, &(0x7f0000000200)='source\x00', &(0x7f0000000300)='127.0.0.1:6789:/\x00', 0x0)
fsconfig$FSCONFIG_SET_STRING(r4, 0x1, &(0x7f0000000400)='ms_mode\x00', &(0x7f0000000500)='crc\x00', 0x0)
fsconfig$FSCONFIG_SET_STRING(r4, 0x1, &(0x7f0000000600)='secret\x00', &(0x7f0000000700)='AQAAAAAAAAAAABAAAAAAAAAAAAAAAAAAAAAAAA==\x00', 0x0)
fsconfig$FSCONFIG_CMD_CREATE(r4, 0x6, 0x0, 0x0, 0x0)
executing program 2:
syz_emit_vhci(0x0, 0x7)
syz_emit_vhci(&(0x7f0000000500)=ANY=[@ANYBLOB="040e04011a0c00"], 0x7)
executing program 2:
r0 = socket$packet(0x11, 0x3, 0x300)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge0\x00', <r1=>0x0})
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'bridge_slave_0\x00'})
r2 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r2, 0x0, 0x0)
sendto$packet(r0, &(0x7f0000000500)="01005e0101010011223344558888aabbccdd", 0x12, 0x0, &(0x7f0000000600)={0x11, 0x8888, r1, 0x1, 0x0, 0x6, @random="01005e010101"}, 0x14)
executing program 2:
bind$bt_hci(0xffffffffffffffff, &(0x7f0000000000)={0x1f, 0xffff, 0x3}, 0x6)
write(0xffffffffffffffff, &(0x7f0000000100)="060000000300010000", 0x9)
nanosleep(&(0x7f0000000200)={0x0, 0x1000000}, 0x0)
syz_emit_vhci(&(0x7f0000000400)=ANY=[@ANYBLOB="040e04013a0c00"], 0x7)
syz_emit_vhci(&(0x7f0000000500)=ANY=[@ANYBLOB="040e04011a0c00"], 0x7)
nanosleep(&(0x7f0000000200)={0x0, 0x5f5e100}, 0x0)
executing program 1:
r0 = socket$packet(0x11, 0x3, 0x300)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'bridge_slave_0\x00', <r1=>0x0})
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='sys\x00', &(0x7f0000000140)='sysfs\x00', 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000180)='sys/class/net/bridge_slave_0/brport/multicast_to_unicast\x00', 0x1, 0x0)
write(r2, &(0x7f0000000200)='1', 0x1)
r3 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000380)=ANY=[@ANYBLOB="3800000054000106010000000000000007000000", @ANYRES32, @ANYBLOB="20000100", @ANYRES32=r1, @ANYBLOB="0100000001005e01010100"/24], 0x38}}, 0x0)
sendto$packet(r0, &(0x7f0000000500)="01005e0101010011223344558888aabbccdd", 0x12, 0x0, &(0x7f0000000600)={0x11, 0x8888, 0x0, 0x1, 0x0, 0x6, @random}, 0x14)
executing program 3:
r0 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'bridge0\x00', <r1=>0x0})
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'veth0\x00', <r2=>0x0})
sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000100)=@newneigh={0x30, 0x1c, 0x601, 0x0, 0x0, {0x2, 0x0, 0x0, r1, 0x80, 0x0, 0x1}, [@NDA_DST_IPV4={0x8, 0x1, @remote}, @NDA_LLADDR={0xa, 0x2, @remote}]}, 0x30}}, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=@newneigh={0x28, 0x1c, 0x601, 0x0, 0x0, {0x7, 0x0, 0x0, r2, 0x80, 0x0, 0x1}, [@NDA_LLADDR={0xa, 0x2, @remote}]}, 0x28}}, 0x0)
executing program 2:
r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0)
bind$bt_l2cap(r0, &(0x7f0000000000)={0x1f, 0x0, @any, 0x4, 0x1}, 0xe)
connect$bt_l2cap(r0, &(0x7f0000000040)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x11}, 0x4, 0x1}, 0xe)
setsockopt(r0, 0x112, 0xe, &(0x7f0000000100)="00060000", 0x4)
nanosleep(&(0x7f0000000200)={0x0, 0x5000000}, 0x0)
syz_emit_vhci(&(0x7f0000000300)=ANY=[@ANYBLOB="043e060c00c9000101"], 0x9)
nanosleep(&(0x7f0000000400)={0x0, 0x20000000}, 0x0)
executing program 3:
syz_emit_vhci(&(0x7f0000000080)=ANY=[@ANYBLOB="040e0c01031000ffffffffffffffff"], 0xf)
syz_emit_vhci(&(0x7f00000000c0)=ANY=[@ANYBLOB="040b0b00c800ffffffffffffffff"], 0xe)
nanosleep(&(0x7f0000000300)={0x0, 0x2faf080}, 0x0)
r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
fcntl$setstatus(r0, 0x4, 0x800)
setsockopt$bt_BT_VOICE(r0, 0x112, 0xb, &(0x7f0000000040)=0x3, 0x2)
connect$bt_sco(r0, &(0x7f0000000000)={0x1f, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}}, 0x8)
syz_emit_vhci(&(0x7f0000000100)=ANY=[@ANYBLOB="042c111f0000aaaaaaaaaa100200000000000000"], 0x14)
executing program 1:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$ETHTOOL_MSG_PAUSE_SET(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000cc0)={&(0x7f0000000780)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16, @ANYBLOB="01000000000000000000200100000c000280080002006c6f000018000380040001000800020005000000080004001f000000"], 0x38}}, 0x0)
executing program 1:
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newlink={0x54, 0x10, 0x401, 0x0, 0x0, {}, [@IFLA_IFNAME={0x14, 0x3, 'batadv0\x00'}, @IFLA_LINKINFO={0x20, 0x12, 0x0, 0x1, @batadv={{0x0, 0x0}, {0x10, 0x2, 0x0, 0x1, [@IFLA_BATADV_ALGO_NAME={0xc, 0x1, 'BATMAN_V'}]}}}]}, 0x54}}, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=@dellink={0x34, 0x11, 0x1, 0x0, 0x0, {}, [@IFLA_IFNAME={0x14, 0x3, 'batadv0\x00'}]}, 0x34}}, 0x0)
executing program 3:
r0 = socket$packet(0x11, 0x3, 0x300)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge0\x00', <r1=>0x0})
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'bridge_slave_0\x00'})
r2 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r2, &(0x7f0000000300)={0x0, 0x0, 0x0}, 0x0)
sendto$packet(r0, &(0x7f0000000500)="01005e0101010011223344558888aabbccdd", 0x12, 0x0, &(0x7f0000000600)={0x11, 0x8888, r1, 0x1, 0x0, 0x6, @random="01005e010101"}, 0x14)
executing program 3:
r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffff, 0x3}, 0x6)
write(r0, &(0x7f0000000100)="060000000300010000", 0x9)
nanosleep(&(0x7f0000000200)={0x3}, 0x0)
write(r0, &(0x7f0000000300)="060000000300000000", 0x9)
nanosleep(&(0x7f0000000400)={0x1}, 0x0)
executing program 1:
r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffff, 0x3}, 0x6)
write(r0, &(0x7f0000000100)="520000002300010100020600"/41, 0x29)
nanosleep(&(0x7f0000000200)={0x0, 0x2faf080}, 0x0)
write(r0, &(0x7f0000000300)="5300000002000000", 0x8)
executing program 0:
r0 = syz_init_net_socket$bt_bnep(0x1f, 0x3, 0x4)
r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0)
bind$bt_l2cap(r1, &(0x7f0000000100)={0x1f, 0x0, @any, 0x40}, 0xe)
ioctl$sock_bt_bnep_BNEPCONNADD(r0, 0x400442c8, &(0x7f0000000300)={r1, 0x0, 0x0, 'bnep0\x00'})
syz_emit_vhci(&(0x7f0000000400)=ANY=[@ANYBLOB="02c82008000400400001030000"], 0xd)
nanosleep(&(0x7f0000000500)={0x0, 0x1dcd6500}, 0x0)
executing program 1:
bind$bt_hci(0xffffffffffffffff, &(0x7f0000000000)={0x1f, 0xffff, 0x3}, 0x6)
write(0xffffffffffffffff, &(0x7f0000000100)="060000000300010000", 0x9)
nanosleep(&(0x7f0000000200)={0x0, 0x1000000}, 0x0)
syz_emit_vhci(&(0x7f0000000400)=ANY=[@ANYBLOB="040e04013a0c00"], 0x7)
syz_emit_vhci(&(0x7f0000000500)=ANY=[@ANYBLOB="040e04011a0c00"], 0x7)
nanosleep(&(0x7f0000000200)={0x0, 0x5f5e100}, 0x0)
executing program 1:
r0 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'batadv0\x00'})
sendmsg$nl_route(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=@dellink={0x20, 0x11, 0x5}, 0x20}}, 0x0)
executing program 2:
r0 = socket$packet(0x11, 0x3, 0x300)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'bridge_slave_0\x00', <r1=>0x0})
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='sys\x00', &(0x7f0000000140)='sysfs\x00', 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000180)='sys/class/net/bridge_slave_0/brport/multicast_to_unicast\x00', 0x1, 0x0)
write(r2, &(0x7f0000000200)='1', 0x1)
r3 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000380)=ANY=[@ANYBLOB="3800000054000106010000000000000007000000", @ANYRES32, @ANYBLOB="20000100", @ANYRES32=r1, @ANYBLOB="0100000001005e01010100"/24], 0x38}}, 0x0)
sendto$packet(r0, &(0x7f0000000500)="01005e0101010011223344558888aabbccdd", 0x12, 0x0, &(0x7f0000000600)={0x11, 0x8888, 0x0, 0x1, 0x0, 0x6, @random}, 0x14)

program crashed: BUG: corrupted list in mgmt_pending_remove
bisect: bisecting 24 programs
bisect: split chunks (needed=false): <24>
bisect: split chunk #0 of len 24 into 3 parts
bisect: testing without sub-chunk 1/3
testing program (duration=34s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [2, 6, 6, 9, 5, 7, 8, 2, 3, 6, 6, 5, 6, 6, 3, 9]
detailed listing:
executing program 2:
syz_emit_vhci(0x0, 0x7)
syz_emit_vhci(&(0x7f0000000500)=ANY=[@ANYBLOB="040e04011a0c00"], 0x7)
executing program 2:
r0 = socket$packet(0x11, 0x3, 0x300)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge0\x00', <r1=>0x0})
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'bridge_slave_0\x00'})
r2 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r2, 0x0, 0x0)
sendto$packet(r0, &(0x7f0000000500)="01005e0101010011223344558888aabbccdd", 0x12, 0x0, &(0x7f0000000600)={0x11, 0x8888, r1, 0x1, 0x0, 0x6, @random="01005e010101"}, 0x14)
executing program 2:
bind$bt_hci(0xffffffffffffffff, &(0x7f0000000000)={0x1f, 0xffff, 0x3}, 0x6)
write(0xffffffffffffffff, &(0x7f0000000100)="060000000300010000", 0x9)
nanosleep(&(0x7f0000000200)={0x0, 0x1000000}, 0x0)
syz_emit_vhci(&(0x7f0000000400)=ANY=[@ANYBLOB="040e04013a0c00"], 0x7)
syz_emit_vhci(&(0x7f0000000500)=ANY=[@ANYBLOB="040e04011a0c00"], 0x7)
nanosleep(&(0x7f0000000200)={0x0, 0x5f5e100}, 0x0)
executing program 1:
r0 = socket$packet(0x11, 0x3, 0x300)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'bridge_slave_0\x00', <r1=>0x0})
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='sys\x00', &(0x7f0000000140)='sysfs\x00', 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000180)='sys/class/net/bridge_slave_0/brport/multicast_to_unicast\x00', 0x1, 0x0)
write(r2, &(0x7f0000000200)='1', 0x1)
r3 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000380)=ANY=[@ANYBLOB="3800000054000106010000000000000007000000", @ANYRES32, @ANYBLOB="20000100", @ANYRES32=r1, @ANYBLOB="0100000001005e01010100"/24], 0x38}}, 0x0)
sendto$packet(r0, &(0x7f0000000500)="01005e0101010011223344558888aabbccdd", 0x12, 0x0, &(0x7f0000000600)={0x11, 0x8888, 0x0, 0x1, 0x0, 0x6, @random}, 0x14)
executing program 3:
r0 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'bridge0\x00', <r1=>0x0})
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'veth0\x00', <r2=>0x0})
sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000100)=@newneigh={0x30, 0x1c, 0x601, 0x0, 0x0, {0x2, 0x0, 0x0, r1, 0x80, 0x0, 0x1}, [@NDA_DST_IPV4={0x8, 0x1, @remote}, @NDA_LLADDR={0xa, 0x2, @remote}]}, 0x30}}, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=@newneigh={0x28, 0x1c, 0x601, 0x0, 0x0, {0x7, 0x0, 0x0, r2, 0x80, 0x0, 0x1}, [@NDA_LLADDR={0xa, 0x2, @remote}]}, 0x28}}, 0x0)
executing program 2:
r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0)
bind$bt_l2cap(r0, &(0x7f0000000000)={0x1f, 0x0, @any, 0x4, 0x1}, 0xe)
connect$bt_l2cap(r0, &(0x7f0000000040)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x11}, 0x4, 0x1}, 0xe)
setsockopt(r0, 0x112, 0xe, &(0x7f0000000100)="00060000", 0x4)
nanosleep(&(0x7f0000000200)={0x0, 0x5000000}, 0x0)
syz_emit_vhci(&(0x7f0000000300)=ANY=[@ANYBLOB="043e060c00c9000101"], 0x9)
nanosleep(&(0x7f0000000400)={0x0, 0x20000000}, 0x0)
executing program 3:
syz_emit_vhci(&(0x7f0000000080)=ANY=[@ANYBLOB="040e0c01031000ffffffffffffffff"], 0xf)
syz_emit_vhci(&(0x7f00000000c0)=ANY=[@ANYBLOB="040b0b00c800ffffffffffffffff"], 0xe)
nanosleep(&(0x7f0000000300)={0x0, 0x2faf080}, 0x0)
r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
fcntl$setstatus(r0, 0x4, 0x800)
setsockopt$bt_BT_VOICE(r0, 0x112, 0xb, &(0x7f0000000040)=0x3, 0x2)
connect$bt_sco(r0, &(0x7f0000000000)={0x1f, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}}, 0x8)
syz_emit_vhci(&(0x7f0000000100)=ANY=[@ANYBLOB="042c111f0000aaaaaaaaaa100200000000000000"], 0x14)
executing program 1:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$ETHTOOL_MSG_PAUSE_SET(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000cc0)={&(0x7f0000000780)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16, @ANYBLOB="01000000000000000000200100000c000280080002006c6f000018000380040001000800020005000000080004001f000000"], 0x38}}, 0x0)
executing program 1:
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newlink={0x54, 0x10, 0x401, 0x0, 0x0, {}, [@IFLA_IFNAME={0x14, 0x3, 'batadv0\x00'}, @IFLA_LINKINFO={0x20, 0x12, 0x0, 0x1, @batadv={{0x0, 0x0}, {0x10, 0x2, 0x0, 0x1, [@IFLA_BATADV_ALGO_NAME={0xc, 0x1, 'BATMAN_V'}]}}}]}, 0x54}}, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=@dellink={0x34, 0x11, 0x1, 0x0, 0x0, {}, [@IFLA_IFNAME={0x14, 0x3, 'batadv0\x00'}]}, 0x34}}, 0x0)
executing program 3:
r0 = socket$packet(0x11, 0x3, 0x300)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge0\x00', <r1=>0x0})
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'bridge_slave_0\x00'})
r2 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r2, &(0x7f0000000300)={0x0, 0x0, 0x0}, 0x0)
sendto$packet(r0, &(0x7f0000000500)="01005e0101010011223344558888aabbccdd", 0x12, 0x0, &(0x7f0000000600)={0x11, 0x8888, r1, 0x1, 0x0, 0x6, @random="01005e010101"}, 0x14)
executing program 3:
r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffff, 0x3}, 0x6)
write(r0, &(0x7f0000000100)="060000000300010000", 0x9)
nanosleep(&(0x7f0000000200)={0x3}, 0x0)
write(r0, &(0x7f0000000300)="060000000300000000", 0x9)
nanosleep(&(0x7f0000000400)={0x1}, 0x0)
executing program 1:
r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffff, 0x3}, 0x6)
write(r0, &(0x7f0000000100)="520000002300010100020600"/41, 0x29)
nanosleep(&(0x7f0000000200)={0x0, 0x2faf080}, 0x0)
write(r0, &(0x7f0000000300)="5300000002000000", 0x8)
executing program 0:
r0 = syz_init_net_socket$bt_bnep(0x1f, 0x3, 0x4)
r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0)
bind$bt_l2cap(r1, &(0x7f0000000100)={0x1f, 0x0, @any, 0x40}, 0xe)
ioctl$sock_bt_bnep_BNEPCONNADD(r0, 0x400442c8, &(0x7f0000000300)={r1, 0x0, 0x0, 'bnep0\x00'})
syz_emit_vhci(&(0x7f0000000400)=ANY=[@ANYBLOB="02c82008000400400001030000"], 0xd)
nanosleep(&(0x7f0000000500)={0x0, 0x1dcd6500}, 0x0)
executing program 1:
bind$bt_hci(0xffffffffffffffff, &(0x7f0000000000)={0x1f, 0xffff, 0x3}, 0x6)
write(0xffffffffffffffff, &(0x7f0000000100)="060000000300010000", 0x9)
nanosleep(&(0x7f0000000200)={0x0, 0x1000000}, 0x0)
syz_emit_vhci(&(0x7f0000000400)=ANY=[@ANYBLOB="040e04013a0c00"], 0x7)
syz_emit_vhci(&(0x7f0000000500)=ANY=[@ANYBLOB="040e04011a0c00"], 0x7)
nanosleep(&(0x7f0000000200)={0x0, 0x5f5e100}, 0x0)
executing program 1:
r0 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'batadv0\x00'})
sendmsg$nl_route(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=@dellink={0x20, 0x11, 0x5}, 0x20}}, 0x0)
executing program 2:
r0 = socket$packet(0x11, 0x3, 0x300)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'bridge_slave_0\x00', <r1=>0x0})
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='sys\x00', &(0x7f0000000140)='sysfs\x00', 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000180)='sys/class/net/bridge_slave_0/brport/multicast_to_unicast\x00', 0x1, 0x0)
write(r2, &(0x7f0000000200)='1', 0x1)
r3 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000380)=ANY=[@ANYBLOB="3800000054000106010000000000000007000000", @ANYRES32, @ANYBLOB="20000100", @ANYRES32=r1, @ANYBLOB="0100000001005e01010100"/24], 0x38}}, 0x0)
sendto$packet(r0, &(0x7f0000000500)="01005e0101010011223344558888aabbccdd", 0x12, 0x0, &(0x7f0000000600)={0x11, 0x8888, 0x0, 0x1, 0x0, 0x6, @random}, 0x14)

program crashed: BUG: corrupted list in mgmt_pending_remove
bisect: the chunk can be dropped
bisect: testing without sub-chunk 2/3
testing program (duration=32s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [3, 6, 6, 5, 6, 6, 3, 9]
detailed listing:
executing program 1:
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newlink={0x54, 0x10, 0x401, 0x0, 0x0, {}, [@IFLA_IFNAME={0x14, 0x3, 'batadv0\x00'}, @IFLA_LINKINFO={0x20, 0x12, 0x0, 0x1, @batadv={{0x0, 0x0}, {0x10, 0x2, 0x0, 0x1, [@IFLA_BATADV_ALGO_NAME={0xc, 0x1, 'BATMAN_V'}]}}}]}, 0x54}}, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=@dellink={0x34, 0x11, 0x1, 0x0, 0x0, {}, [@IFLA_IFNAME={0x14, 0x3, 'batadv0\x00'}]}, 0x34}}, 0x0)
executing program 3:
r0 = socket$packet(0x11, 0x3, 0x300)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge0\x00', <r1=>0x0})
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'bridge_slave_0\x00'})
r2 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r2, &(0x7f0000000300)={0x0, 0x0, 0x0}, 0x0)
sendto$packet(r0, &(0x7f0000000500)="01005e0101010011223344558888aabbccdd", 0x12, 0x0, &(0x7f0000000600)={0x11, 0x8888, r1, 0x1, 0x0, 0x6, @random="01005e010101"}, 0x14)
executing program 3:
r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffff, 0x3}, 0x6)
write(r0, &(0x7f0000000100)="060000000300010000", 0x9)
nanosleep(&(0x7f0000000200)={0x3}, 0x0)
write(r0, &(0x7f0000000300)="060000000300000000", 0x9)
nanosleep(&(0x7f0000000400)={0x1}, 0x0)
executing program 1:
r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffff, 0x3}, 0x6)
write(r0, &(0x7f0000000100)="520000002300010100020600"/41, 0x29)
nanosleep(&(0x7f0000000200)={0x0, 0x2faf080}, 0x0)
write(r0, &(0x7f0000000300)="5300000002000000", 0x8)
executing program 0:
r0 = syz_init_net_socket$bt_bnep(0x1f, 0x3, 0x4)
r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0)
bind$bt_l2cap(r1, &(0x7f0000000100)={0x1f, 0x0, @any, 0x40}, 0xe)
ioctl$sock_bt_bnep_BNEPCONNADD(r0, 0x400442c8, &(0x7f0000000300)={r1, 0x0, 0x0, 'bnep0\x00'})
syz_emit_vhci(&(0x7f0000000400)=ANY=[@ANYBLOB="02c82008000400400001030000"], 0xd)
nanosleep(&(0x7f0000000500)={0x0, 0x1dcd6500}, 0x0)
executing program 1:
bind$bt_hci(0xffffffffffffffff, &(0x7f0000000000)={0x1f, 0xffff, 0x3}, 0x6)
write(0xffffffffffffffff, &(0x7f0000000100)="060000000300010000", 0x9)
nanosleep(&(0x7f0000000200)={0x0, 0x1000000}, 0x0)
syz_emit_vhci(&(0x7f0000000400)=ANY=[@ANYBLOB="040e04013a0c00"], 0x7)
syz_emit_vhci(&(0x7f0000000500)=ANY=[@ANYBLOB="040e04011a0c00"], 0x7)
nanosleep(&(0x7f0000000200)={0x0, 0x5f5e100}, 0x0)
executing program 1:
r0 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'batadv0\x00'})
sendmsg$nl_route(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=@dellink={0x20, 0x11, 0x5}, 0x20}}, 0x0)
executing program 2:
r0 = socket$packet(0x11, 0x3, 0x300)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'bridge_slave_0\x00', <r1=>0x0})
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='sys\x00', &(0x7f0000000140)='sysfs\x00', 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000180)='sys/class/net/bridge_slave_0/brport/multicast_to_unicast\x00', 0x1, 0x0)
write(r2, &(0x7f0000000200)='1', 0x1)
r3 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000380)=ANY=[@ANYBLOB="3800000054000106010000000000000007000000", @ANYRES32, @ANYBLOB="20000100", @ANYRES32=r1, @ANYBLOB="0100000001005e01010100"/24], 0x38}}, 0x0)
sendto$packet(r0, &(0x7f0000000500)="01005e0101010011223344558888aabbccdd", 0x12, 0x0, &(0x7f0000000600)={0x11, 0x8888, 0x0, 0x1, 0x0, 0x6, @random}, 0x14)

program crashed: BUG: corrupted list in mgmt_pending_remove
bisect: the chunk can be dropped
bisect: testing without sub-chunk 3/3
bisect: split chunks (needed=true): <8>
bisect: split chunk #0 of len 8 into 2 parts
bisect: testing without sub-chunk 1/2
testing program (duration=31s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [6, 6, 3, 9]
detailed listing:
executing program 0:
r0 = syz_init_net_socket$bt_bnep(0x1f, 0x3, 0x4)
r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0)
bind$bt_l2cap(r1, &(0x7f0000000100)={0x1f, 0x0, @any, 0x40}, 0xe)
ioctl$sock_bt_bnep_BNEPCONNADD(r0, 0x400442c8, &(0x7f0000000300)={r1, 0x0, 0x0, 'bnep0\x00'})
syz_emit_vhci(&(0x7f0000000400)=ANY=[@ANYBLOB="02c82008000400400001030000"], 0xd)
nanosleep(&(0x7f0000000500)={0x0, 0x1dcd6500}, 0x0)
executing program 1:
bind$bt_hci(0xffffffffffffffff, &(0x7f0000000000)={0x1f, 0xffff, 0x3}, 0x6)
write(0xffffffffffffffff, &(0x7f0000000100)="060000000300010000", 0x9)
nanosleep(&(0x7f0000000200)={0x0, 0x1000000}, 0x0)
syz_emit_vhci(&(0x7f0000000400)=ANY=[@ANYBLOB="040e04013a0c00"], 0x7)
syz_emit_vhci(&(0x7f0000000500)=ANY=[@ANYBLOB="040e04011a0c00"], 0x7)
nanosleep(&(0x7f0000000200)={0x0, 0x5f5e100}, 0x0)
executing program 1:
r0 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'batadv0\x00'})
sendmsg$nl_route(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=@dellink={0x20, 0x11, 0x5}, 0x20}}, 0x0)
executing program 2:
r0 = socket$packet(0x11, 0x3, 0x300)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'bridge_slave_0\x00', <r1=>0x0})
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='sys\x00', &(0x7f0000000140)='sysfs\x00', 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000180)='sys/class/net/bridge_slave_0/brport/multicast_to_unicast\x00', 0x1, 0x0)
write(r2, &(0x7f0000000200)='1', 0x1)
r3 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000380)=ANY=[@ANYBLOB="3800000054000106010000000000000007000000", @ANYRES32, @ANYBLOB="20000100", @ANYRES32=r1, @ANYBLOB="0100000001005e01010100"/24], 0x38}}, 0x0)
sendto$packet(r0, &(0x7f0000000500)="01005e0101010011223344558888aabbccdd", 0x12, 0x0, &(0x7f0000000600)={0x11, 0x8888, 0x0, 0x1, 0x0, 0x6, @random}, 0x14)

program did not crash
bisect: testing without sub-chunk 2/2
testing program (duration=31s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [3, 6, 6, 5]
detailed listing:
executing program 1:
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newlink={0x54, 0x10, 0x401, 0x0, 0x0, {}, [@IFLA_IFNAME={0x14, 0x3, 'batadv0\x00'}, @IFLA_LINKINFO={0x20, 0x12, 0x0, 0x1, @batadv={{0x0, 0x0}, {0x10, 0x2, 0x0, 0x1, [@IFLA_BATADV_ALGO_NAME={0xc, 0x1, 'BATMAN_V'}]}}}]}, 0x54}}, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=@dellink={0x34, 0x11, 0x1, 0x0, 0x0, {}, [@IFLA_IFNAME={0x14, 0x3, 'batadv0\x00'}]}, 0x34}}, 0x0)
executing program 3:
r0 = socket$packet(0x11, 0x3, 0x300)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge0\x00', <r1=>0x0})
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'bridge_slave_0\x00'})
r2 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r2, &(0x7f0000000300)={0x0, 0x0, 0x0}, 0x0)
sendto$packet(r0, &(0x7f0000000500)="01005e0101010011223344558888aabbccdd", 0x12, 0x0, &(0x7f0000000600)={0x11, 0x8888, r1, 0x1, 0x0, 0x6, @random="01005e010101"}, 0x14)
executing program 3:
r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffff, 0x3}, 0x6)
write(r0, &(0x7f0000000100)="060000000300010000", 0x9)
nanosleep(&(0x7f0000000200)={0x3}, 0x0)
write(r0, &(0x7f0000000300)="060000000300000000", 0x9)
nanosleep(&(0x7f0000000400)={0x1}, 0x0)
executing program 1:
r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffff, 0x3}, 0x6)
write(r0, &(0x7f0000000100)="520000002300010100020600"/41, 0x29)
nanosleep(&(0x7f0000000200)={0x0, 0x2faf080}, 0x0)
write(r0, &(0x7f0000000300)="5300000002000000", 0x8)

program crashed: BUG: corrupted list in mgmt_pending_remove
bisect: the chunk can be dropped
bisect: split chunks (needed=true): <4>
bisect: split chunk #0 of len 4 into 2 parts
bisect: testing without sub-chunk 1/2
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [6, 5]
detailed listing:
executing program 3:
r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffff, 0x3}, 0x6)
write(r0, &(0x7f0000000100)="060000000300010000", 0x9)
nanosleep(&(0x7f0000000200)={0x3}, 0x0)
write(r0, &(0x7f0000000300)="060000000300000000", 0x9)
nanosleep(&(0x7f0000000400)={0x1}, 0x0)
executing program 1:
r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffff, 0x3}, 0x6)
write(r0, &(0x7f0000000100)="520000002300010100020600"/41, 0x29)
nanosleep(&(0x7f0000000200)={0x0, 0x2faf080}, 0x0)
write(r0, &(0x7f0000000300)="5300000002000000", 0x8)

program did not crash
bisect: testing without sub-chunk 2/2
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [3, 6]
detailed listing:
executing program 1:
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newlink={0x54, 0x10, 0x401, 0x0, 0x0, {}, [@IFLA_IFNAME={0x14, 0x3, 'batadv0\x00'}, @IFLA_LINKINFO={0x20, 0x12, 0x0, 0x1, @batadv={{0x0, 0x0}, {0x10, 0x2, 0x0, 0x1, [@IFLA_BATADV_ALGO_NAME={0xc, 0x1, 'BATMAN_V'}]}}}]}, 0x54}}, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=@dellink={0x34, 0x11, 0x1, 0x0, 0x0, {}, [@IFLA_IFNAME={0x14, 0x3, 'batadv0\x00'}]}, 0x34}}, 0x0)
executing program 3:
r0 = socket$packet(0x11, 0x3, 0x300)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge0\x00', <r1=>0x0})
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'bridge_slave_0\x00'})
r2 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r2, &(0x7f0000000300)={0x0, 0x0, 0x0}, 0x0)
sendto$packet(r0, &(0x7f0000000500)="01005e0101010011223344558888aabbccdd", 0x12, 0x0, &(0x7f0000000600)={0x11, 0x8888, r1, 0x1, 0x0, 0x6, @random="01005e010101"}, 0x14)

program did not crash
bisect: split chunks (needed=true): <2>, <2>
bisect: split chunk #0 of len 2 into 2 parts
bisect: testing without sub-chunk 1/2
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [6, 6, 5]
detailed listing:
executing program 3:
r0 = socket$packet(0x11, 0x3, 0x300)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge0\x00', <r1=>0x0})
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'bridge_slave_0\x00'})
r2 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r2, &(0x7f0000000300)={0x0, 0x0, 0x0}, 0x0)
sendto$packet(r0, &(0x7f0000000500)="01005e0101010011223344558888aabbccdd", 0x12, 0x0, &(0x7f0000000600)={0x11, 0x8888, r1, 0x1, 0x0, 0x6, @random="01005e010101"}, 0x14)
executing program 3:
r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffff, 0x3}, 0x6)
write(r0, &(0x7f0000000100)="060000000300010000", 0x9)
nanosleep(&(0x7f0000000200)={0x3}, 0x0)
write(r0, &(0x7f0000000300)="060000000300000000", 0x9)
nanosleep(&(0x7f0000000400)={0x1}, 0x0)
executing program 1:
r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffff, 0x3}, 0x6)
write(r0, &(0x7f0000000100)="520000002300010100020600"/41, 0x29)
nanosleep(&(0x7f0000000200)={0x0, 0x2faf080}, 0x0)
write(r0, &(0x7f0000000300)="5300000002000000", 0x8)

program did not crash
bisect: testing without sub-chunk 2/2
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [3, 6, 5]
detailed listing:
executing program 1:
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newlink={0x54, 0x10, 0x401, 0x0, 0x0, {}, [@IFLA_IFNAME={0x14, 0x3, 'batadv0\x00'}, @IFLA_LINKINFO={0x20, 0x12, 0x0, 0x1, @batadv={{0x0, 0x0}, {0x10, 0x2, 0x0, 0x1, [@IFLA_BATADV_ALGO_NAME={0xc, 0x1, 'BATMAN_V'}]}}}]}, 0x54}}, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=@dellink={0x34, 0x11, 0x1, 0x0, 0x0, {}, [@IFLA_IFNAME={0x14, 0x3, 'batadv0\x00'}]}, 0x34}}, 0x0)
executing program 3:
r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffff, 0x3}, 0x6)
write(r0, &(0x7f0000000100)="060000000300010000", 0x9)
nanosleep(&(0x7f0000000200)={0x3}, 0x0)
write(r0, &(0x7f0000000300)="060000000300000000", 0x9)
nanosleep(&(0x7f0000000400)={0x1}, 0x0)
executing program 1:
r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffff, 0x3}, 0x6)
write(r0, &(0x7f0000000100)="520000002300010100020600"/41, 0x29)
nanosleep(&(0x7f0000000200)={0x0, 0x2faf080}, 0x0)
write(r0, &(0x7f0000000300)="5300000002000000", 0x8)

program crashed: BUG: corrupted list in mgmt_pending_remove
bisect: the chunk can be dropped
bisect: split chunk #1 of len 2 into 2 parts
bisect: testing without sub-chunk 1/2
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [3, 5]
detailed listing:
executing program 1:
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newlink={0x54, 0x10, 0x401, 0x0, 0x0, {}, [@IFLA_IFNAME={0x14, 0x3, 'batadv0\x00'}, @IFLA_LINKINFO={0x20, 0x12, 0x0, 0x1, @batadv={{0x0, 0x0}, {0x10, 0x2, 0x0, 0x1, [@IFLA_BATADV_ALGO_NAME={0xc, 0x1, 'BATMAN_V'}]}}}]}, 0x54}}, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=@dellink={0x34, 0x11, 0x1, 0x0, 0x0, {}, [@IFLA_IFNAME={0x14, 0x3, 'batadv0\x00'}]}, 0x34}}, 0x0)
executing program 1:
r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffff, 0x3}, 0x6)
write(r0, &(0x7f0000000100)="520000002300010100020600"/41, 0x29)
nanosleep(&(0x7f0000000200)={0x0, 0x2faf080}, 0x0)
write(r0, &(0x7f0000000300)="5300000002000000", 0x8)

program crashed: BUG: corrupted list in mgmt_pending_remove
bisect: the chunk can be dropped
bisect: testing without sub-chunk 2/2
bisect: no need to test this chunk, it's definitely needed
bisect: split chunks (needed=true): <1>, <1>
bisect: split chunk #0 of len 1 into 2 parts
bisect: no way to further split the chunk
bisect: split chunk #1 of len 1 into 2 parts
bisect: no way to further split the chunk
bisect: 2 programs left: 

executing program 1:
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newlink={0x54, 0x10, 0x401, 0x0, 0x0, {}, [@IFLA_IFNAME={0x14, 0x3, 'batadv0\x00'}, @IFLA_LINKINFO={0x20, 0x12, 0x0, 0x1, @batadv={{0x0, 0x0}, {0x10, 0x2, 0x0, 0x1, [@IFLA_BATADV_ALGO_NAME={0xc, 0x1, 'BATMAN_V'}]}}}]}, 0x54}}, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=@dellink={0x34, 0x11, 0x1, 0x0, 0x0, {}, [@IFLA_IFNAME={0x14, 0x3, 'batadv0\x00'}]}, 0x34}}, 0x0)
executing program 1:
r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffff, 0x3}, 0x6)
write(r0, &(0x7f0000000100)="520000002300010100020600"/41, 0x29)
nanosleep(&(0x7f0000000200)={0x0, 0x2faf080}, 0x0)
write(r0, &(0x7f0000000300)="5300000002000000", 0x8)


bisect: trying to concatenate
bisect: concatenate 2 entries
minimizing program #0 before concatenation
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [2, 5]
detailed listing:
executing program 0:
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newlink={0x54, 0x10, 0x401, 0x0, 0x0, {}, [@IFLA_IFNAME={0x14, 0x3, 'batadv0\x00'}, @IFLA_LINKINFO={0x20, 0x12, 0x0, 0x1, @batadv={{0x0, 0x0}, {0x10, 0x2, 0x0, 0x1, [@IFLA_BATADV_ALGO_NAME={0xc, 0x1, 'BATMAN_V'}]}}}]}, 0x54}}, 0x0)
executing program 1:
r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffff, 0x3}, 0x6)
write(r0, &(0x7f0000000100)="520000002300010100020600"/41, 0x29)
nanosleep(&(0x7f0000000200)={0x0, 0x2faf080}, 0x0)
write(r0, &(0x7f0000000300)="5300000002000000", 0x8)

program crashed: BUG: corrupted list in mgmt_pending_remove
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [1, 5]
detailed listing:
executing program 0:
socket$nl_route(0x10, 0x3, 0x0)
executing program 1:
r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffff, 0x3}, 0x6)
write(r0, &(0x7f0000000100)="520000002300010100020600"/41, 0x29)
nanosleep(&(0x7f0000000200)={0x0, 0x2faf080}, 0x0)
write(r0, &(0x7f0000000300)="5300000002000000", 0x8)

program crashed: BUG: corrupted list in mgmt_pending_remove
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 5]
detailed listing:
executing program 0:
executing program 1:
r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffff, 0x3}, 0x6)
write(r0, &(0x7f0000000100)="520000002300010100020600"/41, 0x29)
nanosleep(&(0x7f0000000200)={0x0, 0x2faf080}, 0x0)
write(r0, &(0x7f0000000300)="5300000002000000", 0x8)

program crashed: BUG: corrupted list in mgmt_pending_remove
minimized 3 calls -> 0 calls
minimizing program #1 before concatenation
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 4]
detailed listing:
executing program 1:
executing program 0:
r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffff, 0x3}, 0x6)
write(r0, &(0x7f0000000100)="520000002300010100020600"/41, 0x29)
nanosleep(&(0x7f0000000200)={0x0, 0x2faf080}, 0x0)

program crashed: BUG: corrupted list in mgmt_pending_remove
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 3]
detailed listing:
executing program 1:
executing program 0:
r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffff, 0x3}, 0x6)
write(r0, &(0x7f0000000100)="520000002300010100020600"/41, 0x29)

program crashed: BUG: corrupted list in mgmt_pending_remove
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 2]
detailed listing:
executing program 1:
executing program 0:
r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffff, 0x3}, 0x6)

program did not crash
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 2]
detailed listing:
executing program 1:
executing program 0:
r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
write(r0, &(0x7f0000000100)="520000002300010100020600"/41, 0x29)

program did not crash
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 2]
detailed listing:
executing program 1:
executing program 0:
bind$bt_hci(0xffffffffffffffff, &(0x7f0000000000)={0x1f, 0xffff, 0x3}, 0x6)
write(0xffffffffffffffff, &(0x7f0000000100)="520000002300010100020600"/41, 0x29)

program did not crash
minimized 5 calls -> 3 calls
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$bt_hci-bind$bt_hci-write
detailed listing:
executing program 0:
r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffff, 0x3}, 0x6)
write(r0, &(0x7f0000000100)="520000002300010100020600"/41, 0x29)

program crashed: BUG: corrupted list in mgmt_pending_remove
bisect: concatenation succeeded
found reproducer with 3 syscalls
minimizing guilty program
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$bt_hci-bind$bt_hci
detailed listing:
executing program 0:
r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffff, 0x3}, 0x6)

program did not crash
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$bt_hci-write
detailed listing:
executing program 0:
r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
write(r0, &(0x7f0000000100)="520000002300010100020600"/41, 0x29)

program did not crash
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bind$bt_hci-write
detailed listing:
executing program 0:
bind$bt_hci(0xffffffffffffffff, &(0x7f0000000000)={0x1f, 0xffff, 0x3}, 0x6)
write(0xffffffffffffffff, &(0x7f0000000100)="520000002300010100020600"/41, 0x29)

program did not crash
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$bt_hci-bind$bt_hci-write
detailed listing:
executing program 0:
r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
bind$bt_hci(r0, 0x0, 0x0)
write(r0, &(0x7f0000000100)="520000002300010100020600"/41, 0x29)

program did not crash
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$bt_hci-bind$bt_hci-write
detailed listing:
executing program 0:
r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffff, 0x3}, 0x6)
write(r0, 0x0, 0x0)

program did not crash
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$bt_hci-bind$bt_hci-write
detailed listing:
executing program 0:
r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffff, 0x3}, 0x6)
write(r0, &(0x7f0000000100), 0x0)

program did not crash
extracting C reproducer
testing compiled C program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$bt_hci-bind$bt_hci-write
program crashed: BUG: corrupted list in mgmt_pending_remove
simplifying C reproducer
testing compiled C program (duration=45s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$bt_hci-bind$bt_hci-write
program crashed: BUG: corrupted list in mgmt_pending_remove
testing compiled C program (duration=45s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$bt_hci-bind$bt_hci-write
program crashed: BUG: corrupted list in mgmt_pending_remove
testing compiled C program (duration=45s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$bt_hci-bind$bt_hci-write
program did not crash
testing compiled C program (duration=45s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$bt_hci-bind$bt_hci-write
program crashed: BUG: corrupted list in mgmt_pending_remove
testing compiled C program (duration=45s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$bt_hci-bind$bt_hci-write
program crashed: BUG: corrupted list in mgmt_pending_remove
testing compiled C program (duration=45s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$bt_hci-bind$bt_hci-write
program crashed: BUG: corrupted list in mgmt_pending_remove
testing compiled C program (duration=45s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$bt_hci-bind$bt_hci-write
program crashed: BUG: corrupted list in mgmt_pending_remove
testing compiled C program (duration=45s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$bt_hci-bind$bt_hci-write
program crashed: BUG: corrupted list in mgmt_pending_remove
testing compiled C program (duration=45s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$bt_hci-bind$bt_hci-write
program did not crash
testing compiled C program (duration=45s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:true Wifi:false IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$bt_hci-bind$bt_hci-write
program crashed: BUG: corrupted list in mgmt_pending_remove
testing compiled C program (duration=45s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:true Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$bt_hci-bind$bt_hci-write
program crashed: BUG: corrupted list in mgmt_pending_remove
testing compiled C program (duration=45s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:true Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$bt_hci-bind$bt_hci-write
program crashed: BUG: corrupted list in mgmt_pending_remove
testing compiled C program (duration=45s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:true Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$bt_hci-bind$bt_hci-write
program crashed: BUG: corrupted list in mgmt_pending_remove
testing compiled C program (duration=45s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:true Wifi:false IEEE802154:false Sysctl:false Swap:true UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$bt_hci-bind$bt_hci-write
program crashed: BUG: corrupted list in mgmt_pending_remove
testing compiled C program (duration=45s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:true Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$bt_hci-bind$bt_hci-write
program crashed: BUG: corrupted list in mgmt_pending_remove
testing program (duration=45s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:true Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$bt_hci-bind$bt_hci-write
detailed listing:
executing program 0:
r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffff, 0x3}, 0x6)
write(r0, &(0x7f0000000100)="520000002300010100020600"/41, 0x29)

program crashed: BUG: corrupted list in mgmt_pending_remove
validation run: crashed=true
testing program (duration=45s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:true Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$bt_hci-bind$bt_hci-write
detailed listing:
executing program 0:
r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffff, 0x3}, 0x6)
write(r0, &(0x7f0000000100)="520000002300010100020600"/41, 0x29)

program crashed: BUG: corrupted list in mgmt_pending_remove
validation run: crashed=true
testing program (duration=45s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:true Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$bt_hci-bind$bt_hci-write
detailed listing:
executing program 0:
r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffff, 0x3}, 0x6)
write(r0, &(0x7f0000000100)="520000002300010100020600"/41, 0x29)

program crashed: BUG: corrupted list in mgmt_pending_remove
validation run: crashed=true
reproducing took 1h8m35.298217263s
repro crashed as (corrupted=false):
list_del corruption, ffff8880766d9180->next is LIST_POISON1 (dead000000000100)
------------[ cut here ]------------
kernel BUG at lib/list_debug.c:58!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 51 Comm: kworker/u5:0 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Workqueue: hci0 hci_cmd_sync_work
RIP: 0010:__list_del_entry_valid_or_report+0xe9/0x130 lib/list_debug.c:56
Code: 48 89 de e8 69 78 49 06 0f 0b 48 c7 c7 60 39 1d 8b 48 89 de e8 58 78 49 06 0f 0b 48 c7 c7 c0 39 1d 8b 48 89 de e8 47 78 49 06 <0f> 0b 48 c7 c7 20 3a 1d 8b 48 89 de e8 36 78 49 06 0f 0b 48 c7 c7
RSP: 0018:ffffc90000bbfa00 EFLAGS: 00010246
RAX: 000000000000004e RBX: ffff8880766d9180 RCX: fc3d1c2f96d6db00
RDX: 0000000000000000 RSI: 0000000080000000 RDI: 0000000000000000
RBP: 1ffff1100ecdb233 R08: ffffc90000bbf707 R09: 1ffff92000177ee0
R10: dffffc0000000000 R11: fffff52000177ee1 R12: dffffc0000000000
R13: dffffc0000000000 R14: dead000000000100 R15: dead000000000122
FS:  0000000000000000(0000) GS:ffff8880b8f00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055e0994d97d0 CR3: 0000000030a51000 CR4: 00000000003506e0
Call Trace:
 <TASK>
 __list_del_entry_valid include/linux/list.h:124 [inline]
 __list_del_entry include/linux/list.h:215 [inline]
 list_del include/linux/list.h:229 [inline]
 mgmt_pending_remove+0x53/0x1f0 net/bluetooth/mgmt_util.c:317
 mgmt_add_adv_patterns_monitor_complete+0x45d/0x730 net/bluetooth/mgmt.c:5417
 hci_cmd_sync_work+0x24b/0x380 net/bluetooth/hci_sync.c:335
 process_one_work kernel/workqueue.c:2657 [inline]
 process_scheduled_works+0xa60/0x1600 kernel/workqueue.c:2734
 worker_thread+0xa5e/0xfe0 kernel/workqueue.c:2815
 kthread+0x2fa/0x390 kernel/kthread.c:388
 ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:152
 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:293
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:__list_del_entry_valid_or_report+0xe9/0x130 lib/list_debug.c:56
Code: 48 89 de e8 69 78 49 06 0f 0b 48 c7 c7 60 39 1d 8b 48 89 de e8 58 78 49 06 0f 0b 48 c7 c7 c0 39 1d 8b 48 89 de e8 47 78 49 06 <0f> 0b 48 c7 c7 20 3a 1d 8b 48 89 de e8 36 78 49 06 0f 0b 48 c7 c7
RSP: 0018:ffffc90000bbfa00 EFLAGS: 00010246
RAX: 000000000000004e RBX: ffff8880766d9180 RCX: fc3d1c2f96d6db00
RDX: 0000000000000000 RSI: 0000000080000000 RDI: 0000000000000000
RBP: 1ffff1100ecdb233 R08: ffffc90000bbf707 R09: 1ffff92000177ee0
R10: dffffc0000000000 R11: fffff52000177ee1 R12: dffffc0000000000
R13: dffffc0000000000 R14: dead000000000100 R15: dead000000000122
FS:  0000000000000000(0000) GS:ffff8880b8f00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055e0994d97d0 CR3: 0000000030a51000 CR4: 00000000003506e0

final repro crashed as (corrupted=false):
list_del corruption, ffff8880766d9180->next is LIST_POISON1 (dead000000000100)
------------[ cut here ]------------
kernel BUG at lib/list_debug.c:58!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 51 Comm: kworker/u5:0 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Workqueue: hci0 hci_cmd_sync_work
RIP: 0010:__list_del_entry_valid_or_report+0xe9/0x130 lib/list_debug.c:56
Code: 48 89 de e8 69 78 49 06 0f 0b 48 c7 c7 60 39 1d 8b 48 89 de e8 58 78 49 06 0f 0b 48 c7 c7 c0 39 1d 8b 48 89 de e8 47 78 49 06 <0f> 0b 48 c7 c7 20 3a 1d 8b 48 89 de e8 36 78 49 06 0f 0b 48 c7 c7
RSP: 0018:ffffc90000bbfa00 EFLAGS: 00010246
RAX: 000000000000004e RBX: ffff8880766d9180 RCX: fc3d1c2f96d6db00
RDX: 0000000000000000 RSI: 0000000080000000 RDI: 0000000000000000
RBP: 1ffff1100ecdb233 R08: ffffc90000bbf707 R09: 1ffff92000177ee0
R10: dffffc0000000000 R11: fffff52000177ee1 R12: dffffc0000000000
R13: dffffc0000000000 R14: dead000000000100 R15: dead000000000122
FS:  0000000000000000(0000) GS:ffff8880b8f00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055e0994d97d0 CR3: 0000000030a51000 CR4: 00000000003506e0
Call Trace:
 <TASK>
 __list_del_entry_valid include/linux/list.h:124 [inline]
 __list_del_entry include/linux/list.h:215 [inline]
 list_del include/linux/list.h:229 [inline]
 mgmt_pending_remove+0x53/0x1f0 net/bluetooth/mgmt_util.c:317
 mgmt_add_adv_patterns_monitor_complete+0x45d/0x730 net/bluetooth/mgmt.c:5417
 hci_cmd_sync_work+0x24b/0x380 net/bluetooth/hci_sync.c:335
 process_one_work kernel/workqueue.c:2657 [inline]
 process_scheduled_works+0xa60/0x1600 kernel/workqueue.c:2734
 worker_thread+0xa5e/0xfe0 kernel/workqueue.c:2815
 kthread+0x2fa/0x390 kernel/kthread.c:388
 ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:152
 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:293
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:__list_del_entry_valid_or_report+0xe9/0x130 lib/list_debug.c:56
Code: 48 89 de e8 69 78 49 06 0f 0b 48 c7 c7 60 39 1d 8b 48 89 de e8 58 78 49 06 0f 0b 48 c7 c7 c0 39 1d 8b 48 89 de e8 47 78 49 06 <0f> 0b 48 c7 c7 20 3a 1d 8b 48 89 de e8 36 78 49 06 0f 0b 48 c7 c7
RSP: 0018:ffffc90000bbfa00 EFLAGS: 00010246
RAX: 000000000000004e RBX: ffff8880766d9180 RCX: fc3d1c2f96d6db00
RDX: 0000000000000000 RSI: 0000000080000000 RDI: 0000000000000000
RBP: 1ffff1100ecdb233 R08: ffffc90000bbf707 R09: 1ffff92000177ee0
R10: dffffc0000000000 R11: fffff52000177ee1 R12: dffffc0000000000
R13: dffffc0000000000 R14: dead000000000100 R15: dead000000000122
FS:  0000000000000000(0000) GS:ffff8880b8f00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055e0994d97d0 CR3: 0000000030a51000 CR4: 00000000003506e0