./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor240917104 <...> Warning: Permanently added '10.128.0.9' (ED25519) to the list of known hosts. execve("./syz-executor240917104", ["./syz-executor240917104"], 0x7ffd8c124710 /* 10 vars */) = 0 brk(NULL) = 0x555586752000 brk(0x555586752e00) = 0x555586752e00 arch_prctl(ARCH_SET_FS, 0x555586752480) = 0 set_tid_address(0x555586752750) = 5835 set_robust_list(0x555586752760, 24) = 0 rseq(0x555586752da0, 0x20, 0, 0x53053053) = 0 prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 readlink("/proc/self/exe", "/root/syz-executor240917104", 4096) = 27 getrandom("\x5e\x05\x8e\x87\x39\xc6\x4f\xe1", 8, GRND_NONBLOCK) = 8 brk(NULL) = 0x555586752e00 brk(0x555586773e00) = 0x555586773e00 brk(0x555586774000) = 0x555586774000 mprotect(0x7f3f1a9a6000, 16384, PROT_READ) = 0 mmap(0x1ffffffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffffffff000 mmap(0x200000000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200000000000 mmap(0x200001000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200001000000 rt_sigaction(SIGRTMIN, {sa_handler=SIG_IGN, sa_mask=[], sa_flags=0}, NULL, 8) = 0 rt_sigaction(SIGRT_1, {sa_handler=SIG_IGN, sa_mask=[], sa_flags=0}, NULL, 8) = 0 rt_sigaction(SIGSEGV, {sa_handler=0x7f3f1a8e76d0, sa_mask=[], sa_flags=SA_RESTORER|SA_NODEFER|SA_SIGINFO, sa_restorer=0x7f3f1a8f35a0}, NULL, 8) = 0 rt_sigaction(SIGBUS, {sa_handler=0x7f3f1a8e76d0, sa_mask=[], sa_flags=SA_RESTORER|SA_NODEFER|SA_SIGINFO, sa_restorer=0x7f3f1a8f35a0}, NULL, 8) = 0 unshare(CLONE_NEWPID) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5836 attached , child_tidptr=0x555586752750) = 5836 [pid 5836] set_robust_list(0x555586752760, 24) = 0 [pid 5836] socket(AF_BLUETOOTH, SOCK_RAW, BTPROTO_HCI) = 3 [pid 5836] openat(AT_FDCWD, "/dev/vhci", O_RDWR) = 4 [pid 5836] dup2(4, 202) = 202 [pid 5836] close(4) = 0 [pid 5836] write(202, "\xff\x00", 2) = 2 [pid 5836] read(202, "\xff\x00\x00\x00", 4) = 4 [pid 5836] rt_sigaction(SIGRT_1, {sa_handler=0x7f3f1a949880, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3f1a8f35a0}, NULL, 8) = 0 [pid 5836] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 5836] mmap(NULL, 8392704, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f3f1a0d4000 [pid 5836] mprotect(0x7f3f1a0d5000, 8388608, PROT_READ|PROT_WRITE) = 0 [pid 5836] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5836] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3f1a8d4990, parent_tid=0x7f3f1a8d4990, exit_signal=0, stack=0x7f3f1a0d4000, stack_size=0x800240, tls=0x7f3f1a8d46c0}./strace-static-x86_64: Process 5839 attached => {parent_tid=[2]}, 88) = 2 [pid 5839] rseq(0x7f3f1a8d4fe0, 0x20, 0, 0x53053053) = 0 [pid 5839] set_robust_list(0x7f3f1a8d49a0, 24 [pid 5836] rt_sigprocmask(SIG_SETMASK, [], [pid 5839] <... set_robust_list resumed>) = 0 [pid 5836] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5839] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5836] ioctl(3, HCIDEVUP [pid 5839] read(202, "\x01\x03\x0c\x00", 1024) = 4 [pid 5839] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x0e\xfc", iov_len=2}, {iov_base="\x01\x03\x0c", iov_len=3}, {iov_base="\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., iov_len=249}], 4) = 255 [pid 5839] read(202, "\x01\x03\x10\x00", 1024) = 4 [pid 5839] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x0e\xfc", iov_len=2}, {iov_base="\x01\x03\x10", iov_len=3}, {iov_base="\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., iov_len=249}], 4) = 255 [pid 5839] read(202, "\x01\x01\x10\x00", 1024) = 4 [pid 5839] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x0e\xfc", iov_len=2}, {iov_base="\x01\x01\x10", iov_len=3}, {iov_base="\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., iov_len=249}], 4) = 255 [pid 5839] read(202, "\x01\x09\x10\x00", 1024) = 4 [pid 5839] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x0e\x0a", iov_len=2}, {iov_base="\x01\x09\x10", iov_len=3}, {iov_base="\x00\xaa\xaa\xaa\xaa\xaa\xaa", iov_len=7}], 4) = 13 [pid 5839] read(202, "\x01\x05\x10\x00", 1024) = 4 [ 91.561223][ T5837] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 91.571597][ T5837] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 91.592461][ T5837] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [pid 5839] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x0e\x0b", iov_len=2}, {iov_base="\x01\x05\x10", iov_len=3}, {iov_base="\x00\xfd\x03\x60\x04\x00\x06\x00", iov_len=8}], 4) = 14 [pid 5839] read(202, "\x01\x23\x0c\x00", 1024) = 4 [pid 5839] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x0e\xfc", iov_len=2}, {iov_base="\x01\x23\x0c", iov_len=3}, {iov_base="\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., iov_len=249}], 4) = 255 [pid 5839] read(202, "\x01\x14\x0c\x00", 1024) = 4 [pid 5839] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x0e\xfc", iov_len=2}, {iov_base="\x01\x14\x0c", iov_len=3}, {iov_base="\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., iov_len=249}], 4) = 255 [pid 5839] read(202, "\x01\x38\x0c\x00", 1024) = 4 [pid 5839] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x0e\xfc", iov_len=2}, {iov_base="\x01\x38\x0c", iov_len=3}, {iov_base="\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., iov_len=249}], 4) = 255 [pid 5839] read(202, "\x01\x39\x0c\x00", 1024) = 4 [pid 5839] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x0e\xfc", iov_len=2}, {iov_base="\x01\x39\x0c", iov_len=3}, {iov_base="\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., iov_len=249}], 4) = 255 [pid 5839] read(202, "\x01\x16\x0c\x02\x00\x7d", 1024) = 6 [pid 5839] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x0e\xfc", iov_len=2}, {iov_base="\x01\x16\x0c", iov_len=3}, {iov_base="\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., iov_len=249}], 4) = 255 [ 91.666074][ T5837] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 91.676202][ T5837] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [pid 5839] read(202, [pid 5836] <... ioctl resumed>, 0) = -1 EALREADY (Operation already in progress) [pid 5836] ioctl(3, HCISETSCAN [pid 5839] <... read resumed>"\x01\x1a\x0c\x01\x02", 1024) = 5 [pid 5839] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x0e\x04", iov_len=2}, {iov_base="\x01\x1a\x0c", iov_len=3}, {iov_base="\x00", iov_len=1}], 4) = 7 [pid 5839] rt_sigprocmask(SIG_BLOCK, ~[RT_1], NULL, 8) = 0 [pid 5836] <... ioctl resumed>, 0x7ffe81776190) = 0 [pid 5839] madvise(0x7f3f1a0d4000, 8372224, MADV_DONTNEED) = 0 [pid 5836] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x04\x0a", iov_len=2}, {iov_base="\xaa\xaa\xaa\xaa\xaa\x10\x00\x00\x00\x01", iov_len=10}], 3 [pid 5839] exit(0 [pid 5836] <... writev resumed>) = 13 [pid 5839] <... exit resumed>) = ? [pid 5836] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x03\x0b", iov_len=2}, {iov_base="\x00\xc8\x00\xaa\xaa\xaa\xaa\xaa\x10\x01\x00", iov_len=11}], 3 [pid 5839] +++ exited with 0 +++ [pid 5836] <... writev resumed>) = 14 [pid 5836] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\v\v", iov_len=2}, {iov_base="\x00\xc8\x00\x00\x00\x00\x00\x00\x00\x00\x00", iov_len=11}], 3) = 14 [pid 5836] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x3e\x13", iov_len=2}, {iov_base="\x01\x00\xc9\x00\x01\x00\xaa\xaa\xaa\xaa\xaa\x11\x00\x00\x00\x00\x00\x00\x00", iov_len=19}], 3) = 22 [pid 5836] close(3) = 0 [pid 5836] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5836] getppid() = 0 [pid 5836] prlimit64(0, RLIMIT_AS, {rlim_cur=204800*1024, rlim_max=204800*1024}, NULL) = 0 [pid 5836] prlimit64(0, RLIMIT_MEMLOCK, {rlim_cur=32768*1024, rlim_max=32768*1024}, NULL) = 0 [pid 5836] prlimit64(0, RLIMIT_FSIZE, {rlim_cur=139264*1024, rlim_max=139264*1024}, NULL) = 0 [pid 5836] prlimit64(0, RLIMIT_STACK, {rlim_cur=1024*1024, rlim_max=1024*1024}, NULL) = 0 [pid 5836] prlimit64(0, RLIMIT_CORE, {rlim_cur=131072*1024, rlim_max=131072*1024}, NULL) = 0 [pid 5836] prlimit64(0, RLIMIT_NOFILE, {rlim_cur=256, rlim_max=256}, NULL) = 0 [pid 5836] unshare(CLONE_NEWNS) = 0 [pid 5836] mount(NULL, "/", NULL, MS_REC|MS_PRIVATE, NULL) = 0 [pid 5836] unshare(CLONE_NEWIPC) = 0 [pid 5836] unshare(CLONE_NEWCGROUP) = 0 [pid 5836] unshare(CLONE_NEWUTS) = 0 [pid 5836] unshare(CLONE_SYSVSEM) = 0 [pid 5836] openat(AT_FDCWD, "/proc/sys/kernel/shmmax", O_WRONLY|O_CLOEXEC) = 3 [pid 5836] write(3, "16777216", 8) = 8 [pid 5836] close(3) = 0 [pid 5836] openat(AT_FDCWD, "/proc/sys/kernel/shmall", O_WRONLY|O_CLOEXEC) = 3 [pid 5836] write(3, "536870912", 9) = 9 [pid 5836] close(3) = 0 [pid 5836] openat(AT_FDCWD, "/proc/sys/kernel/shmmni", O_WRONLY|O_CLOEXEC) = 3 [pid 5836] write(3, "1024", 4) = 4 [pid 5836] close(3) = 0 [pid 5836] openat(AT_FDCWD, "/proc/sys/kernel/msgmax", O_WRONLY|O_CLOEXEC) = 3 [pid 5836] write(3, "8192", 4) = 4 [pid 5836] close(3) = 0 [pid 5836] openat(AT_FDCWD, "/proc/sys/kernel/msgmni", O_WRONLY|O_CLOEXEC) = 3 [pid 5836] write(3, "1024", 4) = 4 [pid 5836] close(3) = 0 [pid 5836] openat(AT_FDCWD, "/proc/sys/kernel/msgmnb", O_WRONLY|O_CLOEXEC) = 3 [pid 5836] write(3, "1024", 4) = 4 [pid 5836] close(3) = 0 [pid 5836] openat(AT_FDCWD, "/proc/sys/kernel/sem", O_WRONLY|O_CLOEXEC) = 3 [pid 5836] write(3, "1024 1048576 500 1024", 21) = 21 [pid 5836] close(3) = 0 [pid 5836] getpid() = 1 [pid 5836] capget({version=_LINUX_CAPABILITY_VERSION_3, pid=1}, {effective=1< [pid 5851] rseq(0x7f3f1a0d3fe0, 0x20, 0, 0x53053053) = 0 [pid 5850] <... clone3 resumed> => {parent_tid=[4]}, 88) = 4 [pid 5851] set_robust_list(0x7f3f1a0d39a0, 24 [pid 5850] rt_sigprocmask(SIG_SETMASK, [], [pid 5851] <... set_robust_list resumed>) = 0 [pid 5850] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5851] rt_sigprocmask(SIG_SETMASK, [], [pid 5850] futex(0x7f3f1a9ac408, FUTEX_WAKE_PRIVATE, 1000000 [pid 5851] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5850] <... futex resumed>) = 0 [pid 5851] socket(AF_PACKET, SOCK_RAW, htons(0 /* ETH_P_??? */)) = 3 [pid 5851] futex(0x7f3f1a9ac40c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5850] futex(0x7f3f1a9ac40c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5851] futex(0x7f3f1a9ac408, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5850] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5850] futex(0x7f3f1a9ac408, FUTEX_WAKE_PRIVATE, 1000000 [pid 5851] <... futex resumed>) = 0 [pid 5851] ioctl(3, SIOCGIFINDEX, {ifr_name="team0" [pid 5850] <... futex resumed>) = 1 [pid 5850] futex(0x7f3f1a9ac40c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5851] <... ioctl resumed>, ifr_ifindex=15}) = 0 [pid 5851] futex(0x7f3f1a9ac40c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5850] <... futex resumed>) = 0 [pid 5851] socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE [pid 5850] futex(0x7f3f1a9ac408, FUTEX_WAKE_PRIVATE, 1000000 [pid 5851] <... socket resumed>) = 4 [pid 5850] <... futex resumed>) = 0 [pid 5850] futex(0x7f3f1a9ac40c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5851] futex(0x7f3f1a9ac40c, FUTEX_WAKE_PRIVATE, 1000000 [pid 5850] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5851] <... futex resumed>) = 0 [pid 5850] futex(0x7f3f1a9ac408, FUTEX_WAKE_PRIVATE, 1000000 [pid 5851] sendmsg(4, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base="\xac\x00\x00\x00\x24\x00\x0b\x0f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x12\x00\x0f\x00\x00\x00\x00\x00\x02\x00\xff\xff\xff\xff\x00\x00\x00\x00\x0b\x00\x01\x00\x74\x61\x70\x72\x69\x6f\x00\x00\x7c\x00\x02\x00\x56\x00\x01\x00\x02\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x08\x00\x04\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., iov_len=172}], msg_iovlen=1, msg_controllen=0, msg_flags=MSG_ZEROCOPY}, 0 [pid 5850] <... futex resumed>) = 0 [pid 5850] futex(0x7f3f1a9ac40c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5851] <... sendmsg resumed>) = 172 [pid 5851] futex(0x7f3f1a9ac40c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5850] <... futex resumed>) = 0 [pid 5850] futex(0x7f3f1a9ac408, FUTEX_WAKE_PRIVATE, 1000000 [pid 5851] clock_settime(CLOCK_REALTIME, {tv_sec=2000000000, tv_nsec=0} [pid 5850] <... futex resumed>) = 0 [ 210.310196][ C0] rcu: INFO: rcu_preempt detected stalls on CPUs/tasks: [ 210.317248][ C0] rcu: 1-...!: (1 GPs behind) idle=faa4/0/0x1 softirq=15614/15615 fqs=1 [ 210.326141][ C0] rcu: (detected by 0, t=10502 jiffies, g=11493, q=107 ncpus=2) [ 210.333876][ C0] Sending NMI from CPU 0 to CPUs 1: [ 210.333909][ C1] NMI backtrace for cpu 1 [ 210.333925][ C1] CPU: 1 UID: 0 PID: 0 Comm: swapper/1 Not tainted 6.15.0-rc2-syzkaller-00278-gfc96b232f8e7 #0 PREEMPT(full) [ 210.333950][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025 [ 210.333962][ C1] RIP: 0010:__lock_acquire+0xaf4/0xd80 [ 210.334017][ C1] Code: 54 24 10 48 89 e9 e8 1b 44 00 00 45 31 ed 85 c0 74 3b 41 f6 46 02 10 75 2e 48 8b 1c 24 48 89 ab e0 0a 00 00 8b 83 e8 0a 00 00 c0 89 83 e8 0a 00 00 83 f8 30 0f 83 b4 01 00 00 3b 05 ed 86 d1 [ 210.334035][ C1] RSP: 0018:ffffc90000a08b50 EFLAGS: 00000046 [ 210.334054][ C1] RAX: 0000000000000000 RBX: ffff88801d6cda00 RCX: 0e05dc09084f7800 [ 210.334070][ C1] RDX: 0000000000000001 RSI: ffff88801d6ce4f0 RDI: ffff88801d6cda00 [ 210.334085][ C1] RBP: 0ac0d5affe09d4ff R08: 0000000000000000 R09: 0000000000000001 [ 210.334099][ C1] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000004008 [ 210.334111][ C1] R13: 0000000000000000 R14: ffff88801d6ce510 R15: 0000000000004008 [ 210.334128][ C1] FS: 0000000000000000(0000) GS:ffff88812509a000(0000) knlGS:0000000000000000 [ 210.334145][ C1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 210.334160][ C1] CR2: 0000200000003c80 CR3: 0000000035800000 CR4: 0000000000350ef0 [ 210.334176][ C1] Call Trace: [ 210.334185][ C1] [ 210.334200][ C1] lock_acquire+0x116/0x2f0 [ 210.334230][ C1] ? advance_sched+0xa02/0xca0 [ 210.334267][ C1] ? advance_sched+0xa02/0xca0 [ 210.334297][ C1] advance_sched+0xa1e/0xca0 [ 210.334325][ C1] ? advance_sched+0xa02/0xca0 [ 210.334362][ C1] ? __pfx_advance_sched+0x10/0x10 [ 210.334391][ C1] __hrtimer_run_queues+0x5a8/0xd40 [ 210.334412][ C1] ? ktime_get_update_offsets_now+0x2d/0x3b0 [ 210.334451][ C1] ? __pfx___hrtimer_run_queues+0x10/0x10 [ 210.334470][ C1] ? srso_alias_return_thunk+0x5/0xfbef5 [ 210.334497][ C1] ? srso_alias_return_thunk+0x5/0xfbef5 [ 210.334521][ C1] ? ktime_get_update_offsets_now+0x38e/0x3b0 [ 210.334554][ C1] hrtimer_interrupt+0x403/0xa40 [ 210.334588][ C1] __sysvec_apic_timer_interrupt+0x112/0x420 [ 210.334624][ C1] sysvec_apic_timer_interrupt+0xa1/0xc0 [ 210.334660][ C1] [ 210.334668][ C1] [ 210.334676][ C1] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 210.334698][ C1] RIP: 0010:pv_native_safe_halt+0x13/0x20 [ 210.334718][ C1] Code: de ae e0 f4 cc cc cc 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa eb 07 0f 00 2d 73 7f 18 00 f3 0f 1e fa fb f4 b3 ae e0 f4 cc cc cc cc cc cc cc cc 90 90 90 90 90 90 90 90 90 [ 210.334735][ C1] RSP: 0018:ffffc90000197dc0 EFLAGS: 00000282 [ 210.334753][ C1] RAX: 0e05dc09084f7800 RBX: ffffffff8197272e RCX: ffffffff8c2fb93c [ 210.334769][ C1] RDX: 0000000000000001 RSI: ffffffff8e6498ee RDI: ffffffff8ca1b720 [ 210.334784][ C1] RBP: ffffc90000197f20 R08: ffff8880b8732b5b R09: 1ffff110170e656b [ 210.334799][ C1] R10: dffffc0000000000 R11: ffffed10170e656c R12: 1ffff92000032fd2 [ 210.334815][ C1] R13: 1ffff11003ad9b40 R14: 0000000000000001 R15: dffffc0000000000 [ 210.334833][ C1] ? do_idle+0x22e/0x5d0 [ 210.334853][ C1] ? ct_kernel_exit+0x12c/0x1a0 [ 210.334879][ C1] default_idle+0x13/0x20 [ 210.334903][ C1] default_idle_call+0x74/0xb0 [ 210.334927][ C1] do_idle+0x22e/0x5d0 [ 210.334951][ C1] ? __pfx_do_idle+0x10/0x10 [ 210.334976][ C1] ? do_idle+0x5a4/0x5d0 [ 210.334998][ C1] cpu_startup_entry+0x42/0x60 [ 210.335017][ C1] start_secondary+0xfe/0x100 [ 210.335036][ C1] common_startup_64+0x13e/0x147 [ 210.335075][ C1] [ 210.335084][ C1] INFO: NMI handler (nmi_cpu_backtrace_handler) took too long to run: 1.176 msecs [ 210.335899][ C0] rcu: rcu_preempt kthread starved for 10500 jiffies! g11493 f0x0 RCU_GP_WAIT_FQS(5) ->state=0x0 ->cpu=0 [ 210.700014][ C0] rcu: Unless rcu_preempt kthread gets sufficient CPU time, OOM is now expected behavior. [ 210.710000][ C0] rcu: RCU grace-period kthread stack dump: [ 210.715898][ C0] task:rcu_preempt state:R running task stack:26376 pid:16 tgid:16 ppid:2 task_flags:0x208040 flags:0x00004000 [ 210.729435][ C0] Call Trace: [ 210.732718][ C0] [ 210.735699][ C0] __schedule+0x1b88/0x5240 [ 210.740243][ C0] ? srso_alias_return_thunk+0x5/0xfbef5 [ 210.745908][ C0] ? srso_alias_return_thunk+0x5/0xfbef5 [ 210.751561][ C0] ? rcu_is_watching+0x15/0xb0 [ 210.756333][ C0] ? schedule+0x163/0x360 [ 210.760716][ C0] ? __pfx___schedule+0x10/0x10 [ 210.765607][ C0] ? srso_alias_return_thunk+0x5/0xfbef5 [ 210.771283][ C0] ? schedule+0x90/0x360 [ 210.775688][ C0] ? schedule+0x90/0x360 [ 210.779959][ C0] schedule+0x163/0x360 [ 210.784166][ C0] schedule_timeout+0x15b/0x2b0 [ 210.789063][ C0] ? __pfx_schedule_timeout+0x10/0x10 [ 210.794472][ C0] ? __pfx_process_timeout+0x10/0x10 [ 210.799804][ C0] ? prepare_to_swait_event+0x1e5/0x340 [ 210.805368][ C0] ? srso_alias_return_thunk+0x5/0xfbef5 [ 210.811022][ C0] ? prepare_to_swait_event+0x308/0x340 [ 210.816607][ C0] rcu_gp_fqs_loop+0x2e1/0x1340 [ 210.821510][ C0] ? __pfx_rcu_watching_snap_save+0x10/0x10 [ 210.827430][ C0] ? __pfx_rcu_gp_fqs_loop+0x10/0x10 [ 210.832736][ C0] ? _raw_spin_unlock_irqrestore+0xde/0x140 [ 210.838667][ C0] ? srso_alias_return_thunk+0x5/0xfbef5 [ 210.844314][ C0] ? finish_swait+0xdb/0x200 [ 210.848929][ C0] ? __pfx_rcu_gp_kthread+0x10/0x10 [ 210.854159][ C0] rcu_gp_kthread+0xa7/0x3b0 [ 210.858790][ C0] ? __pfx_rcu_gp_kthread+0x10/0x10 [ 210.864116][ C0] ? srso_alias_return_thunk+0x5/0xfbef5 [ 210.869766][ C0] ? __kthread_parkme+0x1a8/0x200 [ 210.874804][ C0] ? __pfx_rcu_gp_kthread+0x10/0x10 [ 210.880028][ C0] kthread+0x7b9/0x940 [ 210.884115][ C0] ? __pfx_rcu_gp_kthread+0x10/0x10 [ 210.889345][ C0] ? __pfx_kthread+0x10/0x10 [ 210.893950][ C0] ? __pfx_kthread+0x10/0x10 [ 210.898552][ C0] ? __pfx_kthread+0x10/0x10 [ 210.903155][ C0] ? __pfx_kthread+0x10/0x10 [ 210.907760][ C0] ? srso_alias_return_thunk+0x5/0xfbef5 [ 210.913405][ C0] ? lockdep_hardirqs_on+0x9d/0x150 [ 210.918613][ C0] ? __pfx_kthread+0x10/0x10 [ 210.923215][ C0] ret_from_fork+0x4d/0x80 [ 210.927635][ C0] ? __pfx_kthread+0x10/0x10 [ 210.932235][ C0] ret_from_fork_asm+0x1a/0x30 [ 210.937026][ C0] [ 210.940040][ C0] rcu: Stack dump where RCU GP kthread last ran: [ 210.946451][ C0] CPU: 0 UID: 0 PID: 12 Comm: kworker/u8:0 Not tainted 6.15.0-rc2-syzkaller-00278-gfc96b232f8e7 #0 PREEMPT(full) [ 210.958478][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025 [ 210.968545][ C0] Workqueue: events_unbound toggle_allocation_gate [ 210.975077][ C0] RIP: 0010:smp_call_function_many_cond+0x1baa/0x2d40 [ 210.981865][ C0] Code: b6 04 03 84 c0 75 7e 45 8b 65 00 44 89 e6 83 e6 01 31 ff e8 68 dc 0b 00 41 83 e4 01 4c 8b 64 24 68 75 07 e8 18 d8 0b 00 eb 41 90 48 b8 00 00 00 00 00 fc ff df 0f b6 04 03 84 c0 75 11 41 f7 [ 211.001512][ C0] RSP: 0018:ffffc90000117640 EFLAGS: 00000293 [ 211.007594][ C0] RAX: ffffffff81b6e2cd RBX: 1ffff110170e7e91 RCX: ffff88801c2fda00 [ 211.015589][ C0] RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000 [ 211.023568][ C0] RBP: ffffc90000117840 R08: ffffffff81b6e298 R09: 1ffffffff20bfcce [ 211.031552][ C0] R10: dffffc0000000000 R11: fffffbfff20bfccf R12: ffff8880b863ad08 [ 211.039538][ C0] R13: ffff8880b873f488 R14: ffff8880b863ad00 R15: 0000000000000001 [ 211.047524][ C0] FS: 0000000000000000(0000) GS:ffff888124f9a000(0000) knlGS:0000000000000000 [ 211.056464][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 211.063055][ C0] CR2: 0000200000000600 CR3: 000000000eb38000 CR4: 0000000000350ef0 [ 211.071032][ C0] Call Trace: [ 211.074336][ C0] [ 211.077269][ C0] ? __text_poke+0xb83/0xe20 [ 211.081889][ C0] ? kmem_cache_alloc_bulk_noprof+0x15a/0x7c0 [ 211.087983][ C0] ? kmem_cache_alloc_bulk_noprof+0x15a/0x7c0 [ 211.094073][ C0] ? __pfx___text_poke+0x10/0x10 [ 211.099028][ C0] ? srso_alias_return_thunk+0x5/0xfbef5 [ 211.104687][ C0] ? __pfx_smp_call_function_many_cond+0x10/0x10 [ 211.111039][ C0] ? __pfx___might_resched+0x10/0x10 [ 211.116335][ C0] ? __pfx___mutex_trylock_common+0x10/0x10 [ 211.122282][ C0] ? __pfx_do_sync_core+0x10/0x10 [ 211.127333][ C0] on_each_cpu_cond_mask+0x3f/0x80 [ 211.132472][ C0] text_poke_bp_batch+0x354/0xb30 [ 211.137523][ C0] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 211.143519][ C0] ? arch_jump_label_transform_apply+0x17/0x30 [ 211.149700][ C0] ? __pfx_text_poke_bp_batch+0x10/0x10 [ 211.155265][ C0] ? srso_alias_return_thunk+0x5/0xfbef5 [ 211.160916][ C0] ? srso_alias_return_thunk+0x5/0xfbef5 [ 211.166737][ C0] ? arch_jump_label_transform_queue+0x9b/0x100 [ 211.173091][ C0] ? srso_alias_return_thunk+0x5/0xfbef5 [ 211.178834][ C0] text_poke_finish+0x30/0x50 [ 211.183541][ C0] arch_jump_label_transform_apply+0x1c/0x30 [ 211.189554][ C0] static_key_enable_cpuslocked+0x136/0x260 [ 211.195471][ C0] static_key_enable+0x1a/0x20 [ 211.200251][ C0] toggle_allocation_gate+0xc0/0x250 [ 211.205549][ C0] ? __pfx_toggle_allocation_gate+0x10/0x10 [ 211.211471][ C0] ? srso_alias_return_thunk+0x5/0xfbef5 [ 211.217136][ C0] ? process_scheduled_works+0x9cb/0x18e0 [ 211.222886][ C0] process_scheduled_works+0xac5/0x18e0 [ 211.228495][ C0] ? __pfx_process_scheduled_works+0x10/0x10 [ 211.234523][ C0] ? assign_work+0x367/0x3d0 [ 211.239143][ C0] worker_thread+0x870/0xd50 [ 211.243758][ C0] ? __kthread_parkme+0x1a8/0x200 [ 211.248801][ C0] ? __pfx_worker_thread+0x10/0x10 [ 211.253940][ C0] kthread+0x7b9/0x940 [ 211.258040][ C0] ? __pfx_worker_thread+0x10/0x10 [ 211.263173][ C0] ? __pfx_kthread+0x10/0x10 [ 211.267783][ C0] ? __pfx_kthread+0x10/0x10 [ 211.272429][ C0] ? __pfx_kthread+0x10/0x10 [ 211.277033][ C0] ? __pfx_kthread+0x10/0x10 [ 211.281637][ C0] ? srso_alias_return_thunk+0x5/0xfbef5 [ 211.287283][ C0] ? lockdep_hardirqs_on+0x9d/0x150 [ 211.292499][ C0] ? __pfx_kthread+0x10/0x10 [ 211.297105][ C0] ret_from_fork+0x4d/0x80 [ 211.301536][ C0] ? __pfx_kthread+0x10/0x10 [ 211.306151][ C0] ret_from_fork_asm+0x1a/0x30 [ 211.310944][ C0]