./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor254596934 <...> Warning: Permanently added '10.128.0.136' (ED25519) to the list of known hosts. execve("./syz-executor254596934", ["./syz-executor254596934"], 0x7ffff7147c10 /* 10 vars */) = 0 brk(NULL) = 0x55557acf5000 brk(0x55557acf5d40) = 0x55557acf5d40 arch_prctl(ARCH_SET_FS, 0x55557acf53c0) = 0 set_tid_address(0x55557acf5690) = 5213 set_robust_list(0x55557acf56a0, 24) = 0 rseq(0x55557acf5ce0, 0x20, 0, 0x53053053) = 0 prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 readlink("/proc/self/exe", "/root/syz-executor254596934", 4096) = 27 getrandom("\xc8\xe9\x6a\xf2\x13\x2d\xa4\xb7", 8, GRND_NONBLOCK) = 8 brk(NULL) = 0x55557acf5d40 brk(0x55557ad16d40) = 0x55557ad16d40 brk(0x55557ad17000) = 0x55557ad17000 mprotect(0x7f0b65459000, 16384, PROT_READ) = 0 mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000 mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000 mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5214 attached [pid 5214] set_robust_list(0x55557acf56a0, 24) = 0 [pid 5214] mkdir("./syzkaller.WSAsUy", 0700 [pid 5213] <... clone resumed>, child_tidptr=0x55557acf5690) = 5214 [pid 5213] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5214] <... mkdir resumed>) = 0 [pid 5214] chmod("./syzkaller.WSAsUy", 0777./strace-static-x86_64: Process 5215 attached [pid 5213] <... clone resumed>, child_tidptr=0x55557acf5690) = 5215 [pid 5215] set_robust_list(0x55557acf56a0, 24 [pid 5214] <... chmod resumed>) = 0 [pid 5213] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5214] chdir("./syzkaller.WSAsUy" [pid 5215] <... set_robust_list resumed>) = 0 [pid 5214] <... chdir resumed>) = 0 [pid 5214] unshare(CLONE_NEWPID [pid 5215] mkdir("./syzkaller.RZ4YpX", 0700 [pid 5214] <... unshare resumed>) = 0 ./strace-static-x86_64: Process 5216 attached [pid 5213] <... clone resumed>, child_tidptr=0x55557acf5690) = 5216 [pid 5216] set_robust_list(0x55557acf56a0, 24 [pid 5213] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5216] <... set_robust_list resumed>) = 0 [pid 5215] <... mkdir resumed>) = 0 [pid 5214] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5215] chmod("./syzkaller.RZ4YpX", 0777 [pid 5216] mkdir("./syzkaller.NBo50L", 0700./strace-static-x86_64: Process 5217 attached ./strace-static-x86_64: Process 5218 attached [pid 5213] <... clone resumed>, child_tidptr=0x55557acf5690) = 5217 [pid 5217] set_robust_list(0x55557acf56a0, 24 [pid 5218] set_robust_list(0x55557acf56a0, 24 [pid 5215] <... chmod resumed>) = 0 [pid 5214] <... clone resumed>, child_tidptr=0x55557acf5690) = 5218 [pid 5213] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5217] <... set_robust_list resumed>) = 0 [pid 5218] <... set_robust_list resumed>) = 0 [pid 5216] <... mkdir resumed>) = 0 [pid 5217] mkdir("./syzkaller.dgvehh", 0700 [pid 5218] mount(NULL, "/sys/fs/fuse/connections", "fusectl", 0, NULL [pid 5216] chmod("./syzkaller.NBo50L", 0777./strace-static-x86_64: Process 5219 attached [pid 5215] chdir("./syzkaller.RZ4YpX" [pid 5213] <... clone resumed>, child_tidptr=0x55557acf5690) = 5219 [pid 5219] set_robust_list(0x55557acf56a0, 24) = 0 [pid 5219] mkdir("./syzkaller.CV0F4x", 0700 [pid 5216] <... chmod resumed>) = 0 [ 78.283040][ T29] audit: type=1400 audit(1724634684.921:88): avc: denied { execmem } for pid=5213 comm="syz-executor254" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [pid 5215] <... chdir resumed>) = 0 [pid 5219] <... mkdir resumed>) = 0 [pid 5217] <... mkdir resumed>) = 0 [pid 5218] <... mount resumed>) = -1 EBUSY (Device or resource busy) [pid 5216] chdir("./syzkaller.NBo50L" [pid 5215] unshare(CLONE_NEWPID [pid 5219] chmod("./syzkaller.CV0F4x", 0777 [pid 5216] <... chdir resumed>) = 0 [pid 5215] <... unshare resumed>) = 0 [pid 5219] <... chmod resumed>) = 0 [pid 5218] socket(AF_BLUETOOTH, SOCK_RAW, BTPROTO_HCI [pid 5216] unshare(CLONE_NEWPID [pid 5215] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5218] <... socket resumed>) = 3 [pid 5216] <... unshare resumed>) = 0 [pid 5219] chdir("./syzkaller.CV0F4x" [pid 5216] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5219] <... chdir resumed>) = 0 [pid 5217] chmod("./syzkaller.dgvehh", 0777 [pid 5218] openat(AT_FDCWD, "/dev/vhci", O_RDWR [pid 5219] unshare(CLONE_NEWPID [pid 5217] <... chmod resumed>) = 0 [pid 5218] <... openat resumed>) = 4 [pid 5219] <... unshare resumed>) = 0 [pid 5217] chdir("./syzkaller.dgvehh" [pid 5219] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5217] <... chdir resumed>) = 0 [pid 5217] unshare(CLONE_NEWPID) = 0 [pid 5217] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5216] <... clone resumed>, child_tidptr=0x55557acf5690) = 5221 [pid 5215] <... clone resumed>, child_tidptr=0x55557acf5690) = 5220 [pid 5218] dup2(4, 202) = 202 [pid 5218] close(4) = 0 [pid 5218] write(202, "\xff\x00", 2./strace-static-x86_64: Process 5221 attached ./strace-static-x86_64: Process 5220 attached [pid 5219] <... clone resumed>, child_tidptr=0x55557acf5690) = 5222 [pid 5217] <... clone resumed>, child_tidptr=0x55557acf5690) = 5223 [pid 5218] <... write resumed>) = 2 [pid 5218] read(202, "\xff\x00\x00\x00", 4) = 4 [pid 5221] set_robust_list(0x55557acf56a0, 24 [pid 5220] set_robust_list(0x55557acf56a0, 24 [pid 5218] rt_sigaction(SIGRT_1, {sa_handler=0x7f0b653fd3a0, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0b653ee520}, ./strace-static-x86_64: Process 5223 attached ./strace-static-x86_64: Process 5222 attached [pid 5221] <... set_robust_list resumed>) = 0 [pid 5220] <... set_robust_list resumed>) = 0 [pid 5218] <... rt_sigaction resumed>NULL, 8) = 0 [ 78.338420][ T29] audit: type=1400 audit(1724634684.971:89): avc: denied { mounton } for pid=5218 comm="syz-executor254" path="/sys/fs/fuse/connections" dev="fusectl" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=dir permissive=1 [ 78.362681][ T29] audit: type=1400 audit(1724634684.981:90): avc: denied { mount } for pid=5218 comm="syz-executor254" name="/" dev="fusectl" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=filesystem permissive=1 [pid 5218] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 5218] mmap(NULL, 8392704, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0b64a00000 [pid 5218] mprotect(0x7f0b64a01000, 8388608, PROT_READ|PROT_WRITE) = 0 [pid 5218] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5218] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0b65200990, parent_tid=0x7f0b65200990, exit_signal=0, stack=0x7f0b64a00000, stack_size=0x800300, tls=0x7f0b652006c0} => {parent_tid=[2]}, 88) = 2 [pid 5218] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5218] ioctl(3, HCIDEVUP [ 78.387438][ T29] audit: type=1400 audit(1724634684.981:91): avc: denied { create } for pid=5218 comm="syz-executor254" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 78.407849][ T29] audit: type=1400 audit(1724634684.981:92): avc: denied { read write } for pid=5218 comm="syz-executor254" name="vhci" dev="devtmpfs" ino=1078 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=1 [pid 5223] set_robust_list(0x55557acf56a0, 24) = 0 ./strace-static-x86_64: Process 5226 attached [pid 5222] set_robust_list(0x55557acf56a0, 24 [pid 5221] mount(NULL, "/sys/fs/fuse/connections", "fusectl", 0, NULL [pid 5220] mount(NULL, "/sys/fs/fuse/connections", "fusectl", 0, NULL [pid 5223] mount(NULL, "/sys/fs/fuse/connections", "fusectl", 0, NULL) = -1 EBUSY (Device or resource busy) [pid 5220] <... mount resumed>) = -1 EBUSY (Device or resource busy) [pid 5222] <... set_robust_list resumed>) = 0 [pid 5221] <... mount resumed>) = -1 EBUSY (Device or resource busy) [pid 5220] socket(AF_BLUETOOTH, SOCK_RAW, BTPROTO_HCI [pid 5226] rseq(0x7f0b65200fe0, 0x20, 0, 0x53053053 [pid 5223] socket(AF_BLUETOOTH, SOCK_RAW, BTPROTO_HCI [pid 5226] <... rseq resumed>) = 0 [pid 5222] mount(NULL, "/sys/fs/fuse/connections", "fusectl", 0, NULL [pid 5221] socket(AF_BLUETOOTH, SOCK_RAW, BTPROTO_HCI [pid 5220] <... socket resumed>) = 3 [pid 5226] set_robust_list(0x7f0b652009a0, 24 [pid 5220] openat(AT_FDCWD, "/dev/vhci", O_RDWR [pid 5226] <... set_robust_list resumed>) = 0 [pid 5221] <... socket resumed>) = 3 [pid 5226] rt_sigprocmask(SIG_SETMASK, [], [pid 5223] <... socket resumed>) = 3 [pid 5221] openat(AT_FDCWD, "/dev/vhci", O_RDWR [pid 5220] <... openat resumed>) = 4 [pid 5223] openat(AT_FDCWD, "/dev/vhci", O_RDWR [pid 5226] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5223] <... openat resumed>) = 4 [pid 5221] <... openat resumed>) = 4 [pid 5220] dup2(4, 202 [pid 5226] read(202, [pid 5223] dup2(4, 202 [pid 5222] <... mount resumed>) = -1 EBUSY (Device or resource busy) [pid 5221] dup2(4, 202 [pid 5226] <... read resumed>"\x01\x03\x0c\x00", 1024) = 4 [pid 5223] <... dup2 resumed>) = 202 [pid 5222] socket(AF_BLUETOOTH, SOCK_RAW, BTPROTO_HCI [pid 5220] <... dup2 resumed>) = 202 [pid 5226] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x0e\xfc", iov_len=2}, {iov_base="\x01\x03\x0c", iov_len=3}, {iov_base="\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., iov_len=249}], 4 [pid 5223] close(4 [pid 5221] <... dup2 resumed>) = 202 [pid 5220] close(4 [pid 5226] <... writev resumed>) = 255 [pid 5223] <... close resumed>) = 0 [pid 5222] <... socket resumed>) = 3 [pid 5221] close(4 [pid 5220] <... close resumed>) = 0 [pid 5226] read(202, [pid 5223] write(202, "\xff\x00", 2 [pid 5222] openat(AT_FDCWD, "/dev/vhci", O_RDWR [pid 5221] <... close resumed>) = 0 [ 78.431932][ T29] audit: type=1400 audit(1724634684.981:93): avc: denied { open } for pid=5218 comm="syz-executor254" path="/dev/vhci" dev="devtmpfs" ino=1078 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=1 [ 78.457193][ T29] audit: type=1400 audit(1724634685.021:94): avc: denied { ioctl } for pid=5218 comm="syz-executor254" path="socket:[3058]" dev="sockfs" ino=3058 ioctlcmd=0x48c9 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [pid 5220] write(202, "\xff\x00", 2 [pid 5222] <... openat resumed>) = 4 [pid 5221] write(202, "\xff\x00", 2 [pid 5220] <... write resumed>) = 2 [pid 5222] dup2(4, 202 [pid 5221] <... write resumed>) = 2 [pid 5220] read(202, [pid 5222] <... dup2 resumed>) = 202 [pid 5221] read(202, [pid 5220] <... read resumed>"\xff\x00\x01\x00", 4) = 4 [pid 5222] close(4 [pid 5221] <... read resumed>"\xff\x00\x02\x00", 4) = 4 [pid 5220] rt_sigaction(SIGRT_1, {sa_handler=0x7f0b653fd3a0, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0b653ee520}, [pid 5222] <... close resumed>) = 0 [pid 5221] rt_sigaction(SIGRT_1, {sa_handler=0x7f0b653fd3a0, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0b653ee520}, [pid 5222] write(202, "\xff\x00", 2 [pid 5221] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5221] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 5221] mmap(NULL, 8392704, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0b64a00000 [pid 5221] mprotect(0x7f0b64a01000, 8388608, PROT_READ|PROT_WRITE) = 0 [pid 5221] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5221] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0b65200990, parent_tid=0x7f0b65200990, exit_signal=0, stack=0x7f0b64a00000, stack_size=0x800300, tls=0x7f0b652006c0}./strace-static-x86_64: Process 5229 attached [pid 5226] <... read resumed>"\x01\x03\x10\x00", 1024) = 4 [pid 5223] <... write resumed>) = 2 [pid 5222] <... write resumed>) = 2 [pid 5220] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5226] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x0e\xfc", iov_len=2}, {iov_base="\x01\x03\x10", iov_len=3}, {iov_base="\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., iov_len=249}], 4) = 255 [pid 5226] read(202, [pid 5221] <... clone3 resumed> => {parent_tid=[2]}, 88) = 2 [pid 5221] rt_sigprocmask(SIG_SETMASK, [], [pid 5220] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5221] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5220] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5221] ioctl(3, HCIDEVUP [pid 5220] mmap(NULL, 8392704, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0b64a00000 [ 78.488055][ T5225] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [pid 5220] mprotect(0x7f0b64a01000, 8388608, PROT_READ|PROT_WRITE [pid 5229] rseq(0x7f0b65200fe0, 0x20, 0, 0x53053053 [pid 5223] read(202, [pid 5222] read(202, [pid 5229] <... rseq resumed>) = 0 [pid 5223] <... read resumed>"\xff\x00\x03\x00", 4) = 4 [pid 5222] <... read resumed>"\xff\x00\x04\x00", 4) = 4 [pid 5220] <... mprotect resumed>) = 0 [pid 5220] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5229] set_robust_list(0x7f0b652009a0, 24 [pid 5226] <... read resumed>"\x01\x01\x10\x00", 1024) = 4 [pid 5223] rt_sigaction(SIGRT_1, {sa_handler=0x7f0b653fd3a0, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0b653ee520}, [pid 5222] rt_sigaction(SIGRT_1, {sa_handler=0x7f0b653fd3a0, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0b653ee520}, [pid 5220] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5229] <... set_robust_list resumed>) = 0 [pid 5226] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x0e\xfc", iov_len=2}, {iov_base="\x01\x01\x10", iov_len=3}, {iov_base="\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., iov_len=249}], 4 [pid 5223] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5226] <... writev resumed>) = 255 [pid 5223] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5220] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0b65200990, parent_tid=0x7f0b65200990, exit_signal=0, stack=0x7f0b64a00000, stack_size=0x800300, tls=0x7f0b652006c0} [pid 5226] read(202, ./strace-static-x86_64: Process 5237 attached [pid 5237] rseq(0x7f0b65200fe0, 0x20, 0, 0x53053053 [pid 5229] rt_sigprocmask(SIG_SETMASK, [], [pid 5226] <... read resumed>"\x01\x09\x10\x00", 1024) = 4 [pid 5223] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5222] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5220] <... clone3 resumed> => {parent_tid=[2]}, 88) = 2 [pid 5237] <... rseq resumed>) = 0 [pid 5229] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5226] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x0e\x0a", iov_len=2}, {iov_base="\x01\x09\x10", iov_len=3}, {iov_base="\x00\xaa\xaa\xaa\xaa\xaa\xaa", iov_len=7}], 4 [pid 5237] set_robust_list(0x7f0b652009a0, 24 [pid 5226] <... writev resumed>) = 13 [pid 5223] mmap(NULL, 8392704, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5222] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5220] rt_sigprocmask(SIG_SETMASK, [], [pid 5237] <... set_robust_list resumed>) = 0 [pid 5226] read(202, [pid 5223] <... mmap resumed>) = 0x7f0b64a00000 [pid 5222] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5220] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5237] rt_sigprocmask(SIG_SETMASK, [], [pid 5229] read(202, [pid 5226] <... read resumed>"\x01\x05\x10\x00", 1024) = 4 [pid 5222] mmap(NULL, 8392704, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5220] ioctl(3, HCIDEVUP [pid 5237] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5226] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x0e\x0b", iov_len=2}, {iov_base="\x01\x05\x10", iov_len=3}, {iov_base="\x00\xfd\x03\x60\x04\x00\x06\x00", iov_len=8}], 4 [pid 5223] mprotect(0x7f0b64a01000, 8388608, PROT_READ|PROT_WRITE [pid 5237] read(202, [pid 5226] <... writev resumed>) = 14 [pid 5223] <... mprotect resumed>) = 0 [pid 5222] <... mmap resumed>) = 0x7f0b64a00000 [pid 5226] read(202, [pid 5237] <... read resumed>"\x01\x03\x0c\x00", 1024) = 4 [pid 5229] <... read resumed>"\x01\x03\x0c\x00", 1024) = 4 [pid 5226] <... read resumed>"\x01\x23\x0c\x00", 1024) = 4 [pid 5223] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5237] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x0e\xfc", iov_len=2}, {iov_base="\x01\x03\x0c", iov_len=3}, {iov_base="\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., iov_len=249}], 4 [pid 5229] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x0e\xfc", iov_len=2}, {iov_base="\x01\x03\x0c", iov_len=3}, {iov_base="\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., iov_len=249}], 4 [pid 5226] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x0e\xfc", iov_len=2}, {iov_base="\x01\x23\x0c", iov_len=3}, {iov_base="\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., iov_len=249}], 4 [pid 5222] mprotect(0x7f0b64a01000, 8388608, PROT_READ|PROT_WRITE [pid 5229] <... writev resumed>) = 255 [pid 5226] <... writev resumed>) = 255 [pid 5223] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5229] read(202, [ 78.534292][ T5233] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 78.547523][ T5233] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 78.565755][ T5236] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 78.565761][ T5234] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [pid 5223] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0b65200990, parent_tid=0x7f0b65200990, exit_signal=0, stack=0x7f0b64a00000, stack_size=0x800300, tls=0x7f0b652006c0}./strace-static-x86_64: Process 5238 attached [pid 5237] <... writev resumed>) = 255 [pid 5229] <... read resumed>"\x01\x03\x10\x00", 1024) = 4 [pid 5226] read(202, [pid 5222] <... mprotect resumed>) = 0 [pid 5237] read(202, [pid 5223] <... clone3 resumed> => {parent_tid=[2]}, 88) = 2 [pid 5238] rseq(0x7f0b65200fe0, 0x20, 0, 0x53053053 [pid 5237] <... read resumed>"\x01\x03\x10\x00", 1024) = 4 [pid 5229] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x0e\xfc", iov_len=2}, {iov_base="\x01\x03\x10", iov_len=3}, {iov_base="\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., iov_len=249}], 4 [pid 5226] <... read resumed>"\x01\x14\x0c\x00", 1024) = 4 [pid 5223] rt_sigprocmask(SIG_SETMASK, [], [pid 5222] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5238] <... rseq resumed>) = 0 [pid 5237] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x0e\xfc", iov_len=2}, {iov_base="\x01\x03\x10", iov_len=3}, {iov_base="\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., iov_len=249}], 4 [pid 5229] <... writev resumed>) = 255 [pid 5238] set_robust_list(0x7f0b652009a0, 24 [pid 5222] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5238] <... set_robust_list resumed>) = 0 [pid 5229] read(202, [pid 5222] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0b65200990, parent_tid=0x7f0b65200990, exit_signal=0, stack=0x7f0b64a00000, stack_size=0x800300, tls=0x7f0b652006c0} [pid 5238] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5238] read(202, ./strace-static-x86_64: Process 5239 attached [pid 5237] <... writev resumed>) = 255 [pid 5229] <... read resumed>"\x01\x01\x10\x00", 1024) = 4 [pid 5226] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x0e\xfc", iov_len=2}, {iov_base="\x01\x14\x0c", iov_len=3}, {iov_base="\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., iov_len=249}], 4 [pid 5223] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5222] <... clone3 resumed> => {parent_tid=[2]}, 88) = 2 [pid 5239] rseq(0x7f0b65200fe0, 0x20, 0, 0x53053053 [pid 5238] <... read resumed>"\x01\x03\x0c\x00", 1024) = 4 [pid 5237] read(202, [pid 5229] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x0e\xfc", iov_len=2}, {iov_base="\x01\x01\x10", iov_len=3}, {iov_base="\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., iov_len=249}], 4 [pid 5226] <... writev resumed>) = 255 [pid 5223] ioctl(3, HCIDEVUP [pid 5222] rt_sigprocmask(SIG_SETMASK, [], [pid 5239] <... rseq resumed>) = 0 [pid 5238] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x0e\xfc", iov_len=2}, {iov_base="\x01\x03\x0c", iov_len=3}, {iov_base="\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., iov_len=249}], 4 [pid 5237] <... read resumed>"\x01\x01\x10\x00", 1024) = 4 [pid 5229] <... writev resumed>) = 255 [ 78.573471][ T5234] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 78.594882][ T5234] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 78.602837][ T5233] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 78.613737][ T5233] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 78.616009][ T5234] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [pid 5239] set_robust_list(0x7f0b652009a0, 24 [pid 5237] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x0e\xfc", iov_len=2}, {iov_base="\x01\x01\x10", iov_len=3}, {iov_base="\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., iov_len=249}], 4 [pid 5226] read(202, [pid 5239] <... set_robust_list resumed>) = 0 [pid 5239] rt_sigprocmask(SIG_SETMASK, [], [pid 5238] <... writev resumed>) = 255 [pid 5237] <... writev resumed>) = 255 [pid 5226] <... read resumed>"\x01\x25\x0c\x00", 1024) = 4 [pid 5222] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5238] read(202, [pid 5239] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5238] <... read resumed>"\x01\x03\x10\x00", 1024) = 4 [pid 5237] read(202, [pid 5229] read(202, [pid 5226] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x0e\xfc", iov_len=2}, {iov_base="\x01\x25\x0c", iov_len=3}, {iov_base="\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., iov_len=249}], 4 [pid 5222] ioctl(3, HCIDEVUP [pid 5237] <... read resumed>"\x01\x09\x10\x00", 1024) = 4 [pid 5229] <... read resumed>"\x01\x09\x10\x00", 1024) = 4 [pid 5239] read(202, [pid 5238] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x0e\xfc", iov_len=2}, {iov_base="\x01\x03\x10", iov_len=3}, {iov_base="\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., iov_len=249}], 4 [pid 5229] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x0e\x0a", iov_len=2}, {iov_base="\x01\x09\x10", iov_len=3}, {iov_base="\x00\xaa\xaa\xaa\xaa\xaa\xaa", iov_len=7}], 4 [pid 5226] <... writev resumed>) = 255 [pid 5239] <... read resumed>"\x01\x03\x0c\x00", 1024) = 4 [pid 5238] <... writev resumed>) = 255 [pid 5237] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x0e\x0a", iov_len=2}, {iov_base="\x01\x09\x10", iov_len=3}, {iov_base="\x00\xaa\xaa\xaa\xaa\xaa\xaa", iov_len=7}], 4 [pid 5229] <... writev resumed>) = 13 [pid 5237] <... writev resumed>) = 13 [pid 5226] read(202, [pid 5237] read(202, [pid 5229] read(202, "\x01\x05\x10\x00", 1024) = 4 [pid 5229] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x0e\x0b", iov_len=2}, {iov_base="\x01\x05\x10", iov_len=3}, {iov_base="\x00\xfd\x03\x60\x04\x00\x06\x00", iov_len=8}], 4) = 14 [pid 5229] read(202, [pid 5239] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x0e\xfc", iov_len=2}, {iov_base="\x01\x03\x0c", iov_len=3}, {iov_base="\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., iov_len=249}], 4 [pid 5238] read(202, [pid 5237] <... read resumed>"\x01\x05\x10\x00", 1024) = 4 [pid 5229] <... read resumed>"\x01\x23\x0c\x00", 1024) = 4 [pid 5226] <... read resumed>"\x01\x38\x0c\x00", 1024) = 4 [pid 5239] <... writev resumed>) = 255 [pid 5238] <... read resumed>"\x01\x01\x10\x00", 1024) = 4 [pid 5237] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x0e\x0b", iov_len=2}, {iov_base="\x01\x05\x10", iov_len=3}, {iov_base="\x00\xfd\x03\x60\x04\x00\x06\x00", iov_len=8}], 4 [pid 5229] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x0e\xfc", iov_len=2}, {iov_base="\x01\x23\x0c", iov_len=3}, {iov_base="\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., iov_len=249}], 4 [pid 5226] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x0e\xfc", iov_len=2}, {iov_base="\x01\x38\x0c", iov_len=3}, {iov_base="\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., iov_len=249}], 4 [pid 5239] read(202, [pid 5238] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x0e\xfc", iov_len=2}, {iov_base="\x01\x01\x10", iov_len=3}, {iov_base="\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., iov_len=249}], 4 [pid 5237] <... writev resumed>) = 14 [pid 5229] <... writev resumed>) = 255 [pid 5226] <... writev resumed>) = 255 [pid 5238] <... writev resumed>) = 255 [pid 5237] read(202, [pid 5229] read(202, [pid 5238] read(202, [pid 5237] <... read resumed>"\x01\x23\x0c\x00", 1024) = 4 [ 78.628641][ T5234] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 78.638735][ T5234] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 78.639095][ T5236] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 78.661659][ T5236] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 78.670437][ T5234] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 78.677608][ T5234] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [pid 5237] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x0e\xfc", iov_len=2}, {iov_base="\x01\x23\x0c", iov_len=3}, {iov_base="\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., iov_len=249}], 4) = 255 [pid 5237] read(202, [pid 5239] <... read resumed>"\x01\x03\x10\x00", 1024) = 4 [pid 5238] <... read resumed>"\x01\x09\x10\x00", 1024) = 4 [pid 5226] read(202, [pid 5239] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x0e\xfc", iov_len=2}, {iov_base="\x01\x03\x10", iov_len=3}, {iov_base="\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., iov_len=249}], 4 [pid 5238] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x0e\x0a", iov_len=2}, {iov_base="\x01\x09\x10", iov_len=3}, {iov_base="\x00\xaa\xaa\xaa\xaa\xaa\xaa", iov_len=7}], 4 [pid 5226] <... read resumed>"\x01\x39\x0c\x00", 1024) = 4 [pid 5237] <... read resumed>"\x01\x14\x0c\x00", 1024) = 4 [pid 5229] <... read resumed>"\x01\x14\x0c\x00", 1024) = 4 [pid 5237] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x0e\xfc", iov_len=2}, {iov_base="\x01\x14\x0c", iov_len=3}, {iov_base="\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., iov_len=249}], 4 [pid 5229] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x0e\xfc", iov_len=2}, {iov_base="\x01\x14\x0c", iov_len=3}, {iov_base="\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., iov_len=249}], 4 [pid 5237] <... writev resumed>) = 255 [pid 5229] <... writev resumed>) = 255 [pid 5237] read(202, [pid 5229] read(202, [pid 5237] <... read resumed>"\x01\x25\x0c\x00", 1024) = 4 [pid 5237] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x0e\xfc", iov_len=2}, {iov_base="\x01\x25\x0c", iov_len=3}, {iov_base="\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., iov_len=249}], 4 [pid 5239] <... writev resumed>) = 255 [pid 5238] <... writev resumed>) = 13 [pid 5229] <... read resumed>"\x01\x25\x0c\x00", 1024) = 4 [pid 5226] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x0e\xfc", iov_len=2}, {iov_base="\x01\x39\x0c", iov_len=3}, {iov_base="\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., iov_len=249}], 4 [pid 5239] read(202, [pid 5238] read(202, [pid 5239] <... read resumed>"\x01\x01\x10\x00", 1024) = 4 [pid 5226] <... writev resumed>) = 255 [pid 5239] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x0e\xfc", iov_len=2}, {iov_base="\x01\x01\x10", iov_len=3}, {iov_base="\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., iov_len=249}], 4 [pid 5226] read(202, [pid 5239] <... writev resumed>) = 255 [pid 5238] <... read resumed>"\x01\x05\x10\x00", 1024) = 4 [pid 5237] <... writev resumed>) = 255 [pid 5229] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x0e\xfc", iov_len=2}, {iov_base="\x01\x25\x0c", iov_len=3}, {iov_base="\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., iov_len=249}], 4 [pid 5239] read(202, [pid 5238] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x0e\x0b", iov_len=2}, {iov_base="\x01\x05\x10", iov_len=3}, {iov_base="\x00\xfd\x03\x60\x04\x00\x06\x00", iov_len=8}], 4 [pid 5229] <... writev resumed>) = 255 [pid 5226] <... read resumed>"\x01\x16\x0c\x02\x00\x7d", 1024) = 6 [pid 5226] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x0e\xfc", iov_len=2}, {iov_base="\x01\x16\x0c", iov_len=3}, {iov_base="\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., iov_len=249}], 4) = 255 [pid 5226] read(202, [pid 5237] read(202, "\x01\x38\x0c\x00", 1024) = 4 [ 78.684781][ T5236] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 78.691952][ T5236] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 78.700816][ T5236] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 78.705123][ T5233] Bluetooth: hci1: unexpected cc 0x0c25 length: 249 > 3 [ 78.716596][ T5234] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 78.719246][ T5233] Bluetooth: hci2: unexpected cc 0x0c25 length: 249 > 3 [pid 5237] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x0e\xfc", iov_len=2}, {iov_base="\x01\x38\x0c", iov_len=3}, {iov_base="\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., iov_len=249}], 4) = 255 [pid 5239] <... read resumed>"\x01\x09\x10\x00", 1024) = 4 [pid 5238] <... writev resumed>) = 14 [pid 5229] read(202, [pid 5218] <... ioctl resumed>, 0) = -1 EALREADY (Operation already in progress) [pid 5239] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x0e\x0a", iov_len=2}, {iov_base="\x01\x09\x10", iov_len=3}, {iov_base="\x00\xaa\xaa\xaa\xaa\xaa\xaa", iov_len=7}], 4 [pid 5238] read(202, [pid 5229] <... read resumed>"\x01\x38\x0c\x00", 1024) = 4 [pid 5218] ioctl(3, HCISETSCAN [pid 5239] <... writev resumed>) = 13 [pid 5238] <... read resumed>"\x01\x23\x0c\x00", 1024) = 4 [pid 5237] read(202, [pid 5239] read(202, [pid 5237] <... read resumed>"\x01\x39\x0c\x00", 1024) = 4 [pid 5239] <... read resumed>"\x01\x05\x10\x00", 1024) = 4 [pid 5239] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x0e\x0b", iov_len=2}, {iov_base="\x01\x05\x10", iov_len=3}, {iov_base="\x00\xfd\x03\x60\x04\x00\x06\x00", iov_len=8}], 4 [pid 5237] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x0e\xfc", iov_len=2}, {iov_base="\x01\x39\x0c", iov_len=3}, {iov_base="\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., iov_len=249}], 4 [pid 5239] <... writev resumed>) = 14 [pid 5238] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x0e\xfc", iov_len=2}, {iov_base="\x01\x23\x0c", iov_len=3}, {iov_base="\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., iov_len=249}], 4 [pid 5229] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x0e\xfc", iov_len=2}, {iov_base="\x01\x38\x0c", iov_len=3}, {iov_base="\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., iov_len=249}], 4 [pid 5226] <... read resumed>"\x01\x1a\x0c\x01\x02", 1024) = 5 [pid 5239] read(202, [pid 5237] <... writev resumed>) = 255 [pid 5237] read(202, [pid 5226] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x0e\x04", iov_len=2}, {iov_base="\x01\x1a\x0c", iov_len=3}, {iov_base="\x00", iov_len=1}], 4 [pid 5238] <... writev resumed>) = 255 [pid 5226] <... writev resumed>) = 7 [pid 5229] <... writev resumed>) = 255 [pid 5226] rt_sigprocmask(SIG_BLOCK, ~[RT_1], [pid 5238] read(202, [pid 5229] read(202, [pid 5226] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5239] <... read resumed>"\x01\x23\x0c\x00", 1024) = 4 [pid 5238] <... read resumed>"\x01\x14\x0c\x00", 1024) = 4 [pid 5229] <... read resumed>"\x01\x39\x0c\x00", 1024) = 4 [pid 5226] madvise(0x7f0b64a00000, 8372224, MADV_DONTNEED [pid 5237] <... read resumed>"\x01\x16\x0c\x02\x00\x7d", 1024) = 6 [pid 5226] <... madvise resumed>) = 0 [pid 5238] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x0e\xfc", iov_len=2}, {iov_base="\x01\x14\x0c", iov_len=3}, {iov_base="\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., iov_len=249}], 4 [pid 5229] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x0e\xfc", iov_len=2}, {iov_base="\x01\x39\x0c", iov_len=3}, {iov_base="\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., iov_len=249}], 4 [pid 5226] exit(0 [pid 5238] <... writev resumed>) = 255 [pid 5237] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x0e\xfc", iov_len=2}, {iov_base="\x01\x16\x0c", iov_len=3}, {iov_base="\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., iov_len=249}], 4 [pid 5229] <... writev resumed>) = 255 [pid 5226] <... exit resumed>) = ? [pid 5218] <... ioctl resumed>, 0x7fff61787a40) = 0 [pid 5237] <... writev resumed>) = 255 [pid 5226] +++ exited with 0 +++ [pid 5218] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x04\x0a", iov_len=2}, {iov_base="\xaa\xaa\xaa\xaa\xaa\x10\x00\x00\x00\x01", iov_len=10}], 3 [pid 5238] read(202, [pid 5229] read(202, [pid 5237] read(202, [pid 5218] <... writev resumed>) = 13 [pid 5218] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x03\x0b", iov_len=2}, {iov_base="\x00\xc8\x00\xaa\xaa\xaa\xaa\xaa\x10\x01\x00", iov_len=11}], 3) = 14 [pid 5218] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\v\v", iov_len=2}, {iov_base="\x00\xc8\x00\x00\x00\x00\x00\x00\x00\x00\x00", iov_len=11}], 3) = 14 [pid 5218] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x3e\x13", iov_len=2}, {iov_base="\x01\x00\xc9\x00\x01\x00\xaa\xaa\xaa\xaa\xaa\x11\x00\x00\x00\x00\x00\x00\x00", iov_len=19}], 3) = 22 [pid 5218] close(3) = 0 [pid 5218] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5218] setsid() = 1 [ 78.730600][ T5234] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 78.752270][ T5233] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 78.758280][ T5234] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [pid 5218] openat(AT_FDCWD, "/proc/self/ns/net", O_RDONLY) = 3 [pid 5239] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x0e\xfc", iov_len=2}, {iov_base="\x01\x23\x0c", iov_len=3}, {iov_base="\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., iov_len=249}], 4 [pid 5238] <... read resumed>"\x01\x25\x0c\x00", 1024) = 4 [pid 5229] <... read resumed>"\x01\x16\x0c\x02\x00\x7d", 1024) = 6 [pid 5239] <... writev resumed>) = 255 [pid 5238] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x0e\xfc", iov_len=2}, {iov_base="\x01\x25\x0c", iov_len=3}, {iov_base="\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., iov_len=249}], 4 [pid 5239] read(202, [pid 5220] <... ioctl resumed>, 0x1) = -1 EALREADY (Operation already in progress) [pid 5238] <... writev resumed>) = 255 [pid 5238] read(202, [pid 5220] ioctl(3, HCISETSCAN [pid 5237] <... read resumed>"\x01\x1a\x0c\x01\x02", 1024) = 5 [pid 5237] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x0e\x04", iov_len=2}, {iov_base="\x01\x1a\x0c", iov_len=3}, {iov_base="\x00", iov_len=1}], 4) = 7 [pid 5237] rt_sigprocmask(SIG_BLOCK, ~[RT_1], NULL, 8) = 0 [pid 5237] madvise(0x7f0b64a00000, 8372224, MADV_DONTNEED) = 0 [pid 5237] exit(0) = ? [pid 5237] +++ exited with 0 +++ [pid 5220] <... ioctl resumed>, 0x7fff61787a40) = 0 [pid 5220] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x04\x0a", iov_len=2}, {iov_base="\xaa\xaa\xaa\xaa\xaa\x10\x00\x00\x00\x01", iov_len=10}], 3) = 13 [pid 5220] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x03\x0b", iov_len=2}, {iov_base="\x00\xc8\x00\xaa\xaa\xaa\xaa\xaa\x10\x01\x00", iov_len=11}], 3) = 14 [pid 5220] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\v\v", iov_len=2}, {iov_base="\x00\xc8\x00\x00\x00\x00\x00\x00\x00\x00\x00", iov_len=11}], 3) = 14 [pid 5220] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x3e\x13", iov_len=2}, {iov_base="\x01\x00\xc9\x00\x01\x00\xaa\xaa\xaa\xaa\xaa\x11\x00\x00\x00\x00\x00\x00\x00", iov_len=19}], 3) = 22 [pid 5220] close(3) = 0 [pid 5220] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5220] setsid() = 1 [pid 5220] openat(AT_FDCWD, "/proc/self/ns/net", O_RDONLY) = 3 [pid 5220] dup2(3, 201) = 201 [pid 5220] close(3) = 0 [pid 5220] prlimit64(0, RLIMIT_AS, {rlim_cur=204800*1024, rlim_max=204800*1024}, NULL) = 0 [pid 5220] prlimit64(0, RLIMIT_MEMLOCK, {rlim_cur=32768*1024, rlim_max=32768*1024}, NULL) = 0 [pid 5220] prlimit64(0, RLIMIT_FSIZE, {rlim_cur=139264*1024, rlim_max=139264*1024}, NULL) = 0 [pid 5220] prlimit64(0, RLIMIT_STACK, {rlim_cur=1024*1024, rlim_max=1024*1024}, NULL) = 0 [pid 5220] prlimit64(0, RLIMIT_CORE, {rlim_cur=131072*1024, rlim_max=131072*1024}, NULL) = 0 [pid 5220] prlimit64(0, RLIMIT_NOFILE, {rlim_cur=256, rlim_max=256}, NULL) = 0 [pid 5220] unshare(CLONE_NEWNS) = 0 [pid 5220] mount(NULL, "/", NULL, MS_REC|MS_PRIVATE, NULL) = 0 [pid 5220] unshare(CLONE_NEWIPC [pid 5229] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x0e\xfc", iov_len=2}, {iov_base="\x01\x16\x0c", iov_len=3}, {iov_base="\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., iov_len=249}], 4 [pid 5238] <... read resumed>"\x01\x38\x0c\x00", 1024) = 4 [pid 5229] <... writev resumed>) = 255 [pid 5238] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x0e\xfc", iov_len=2}, {iov_base="\x01\x38\x0c", iov_len=3}, {iov_base="\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., iov_len=249}], 4 [pid 5229] read(202, [pid 5220] <... unshare resumed>) = 0 [pid 5218] dup2(3, 201 [pid 5238] <... writev resumed>) = 255 [pid 5218] <... dup2 resumed>) = 201 [ 78.778153][ T29] audit: type=1400 audit(1724634685.411:95): avc: denied { read } for pid=5218 comm="syz-executor254" dev="nsfs" ino=4026531840 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 78.801188][ T5234] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 78.801311][ T5233] Bluetooth: hci3: unexpected cc 0x0c25 length: 249 > 3 [ 78.819669][ T5233] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [pid 5221] <... ioctl resumed>, 0x2) = -1 EALREADY (Operation already in progress) [pid 5239] <... read resumed>"\x01\x14\x0c\x00", 1024) = 4 [pid 5238] read(202, [pid 5220] unshare(CLONE_NEWCGROUP [pid 5218] close(3 [pid 5221] ioctl(3, HCISETSCAN [pid 5218] <... close resumed>) = 0 [pid 5238] <... read resumed>"\x01\x39\x0c\x00", 1024) = 4 [pid 5218] prlimit64(0, RLIMIT_AS, {rlim_cur=204800*1024, rlim_max=204800*1024}, [pid 5238] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x0e\xfc", iov_len=2}, {iov_base="\x01\x39\x0c", iov_len=3}, {iov_base="\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., iov_len=249}], 4 [pid 5218] <... prlimit64 resumed>NULL) = 0 [pid 5238] <... writev resumed>) = 255 [pid 5220] <... unshare resumed>) = 0 [pid 5218] prlimit64(0, RLIMIT_MEMLOCK, {rlim_cur=32768*1024, rlim_max=32768*1024}, [pid 5238] read(202, [pid 5239] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x0e\xfc", iov_len=2}, {iov_base="\x01\x14\x0c", iov_len=3}, {iov_base="\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., iov_len=249}], 4 [pid 5218] <... prlimit64 resumed>NULL) = 0 [pid 5239] <... writev resumed>) = 255 [pid 5218] prlimit64(0, RLIMIT_FSIZE, {rlim_cur=139264*1024, rlim_max=139264*1024}, [pid 5239] read(202, [pid 5218] <... prlimit64 resumed>NULL) = 0 [pid 5229] <... read resumed>"\x01\x1a\x0c\x01\x02", 1024) = 5 [pid 5218] prlimit64(0, RLIMIT_STACK, {rlim_cur=1024*1024, rlim_max=1024*1024}, [pid 5229] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x0e\x04", iov_len=2}, {iov_base="\x01\x1a\x0c", iov_len=3}, {iov_base="\x00", iov_len=1}], 4 [pid 5218] <... prlimit64 resumed>NULL) = 0 [pid 5229] <... writev resumed>) = 7 [pid 5218] prlimit64(0, RLIMIT_CORE, {rlim_cur=131072*1024, rlim_max=131072*1024}, NULL) = 0 [pid 5238] <... read resumed>"\x01\x16\x0c\x02\x00\x7d", 1024) = 6 [pid 5239] <... read resumed>"\x01\x25\x0c\x00", 1024) = 4 [pid 5218] prlimit64(0, RLIMIT_NOFILE, {rlim_cur=256, rlim_max=256}, [pid 5220] unshare(CLONE_NEWUTS [pid 5218] <... prlimit64 resumed>NULL) = 0 [pid 5239] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x0e\xfc", iov_len=2}, {iov_base="\x01\x25\x0c", iov_len=3}, {iov_base="\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., iov_len=249}], 4 [pid 5238] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x0e\xfc", iov_len=2}, {iov_base="\x01\x16\x0c", iov_len=3}, {iov_base="\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., iov_len=249}], 4) = 255 [pid 5220] <... unshare resumed>) = 0 [pid 5218] unshare(CLONE_NEWNS [pid 5239] <... writev resumed>) = 255 [pid 5238] read(202, [pid 5229] rt_sigprocmask(SIG_BLOCK, ~[RT_1], [pid 5218] <... unshare resumed>) = 0 [pid 5239] read(202, [pid 5229] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5218] mount(NULL, "/", NULL, MS_REC|MS_PRIVATE, NULL [pid 5229] madvise(0x7f0b64a00000, 8372224, MADV_DONTNEED [pid 5223] <... ioctl resumed>, 0x3) = -1 EALREADY (Operation already in progress) [pid 5218] <... mount resumed>) = 0 [pid 5239] <... read resumed>"\x01\x38\x0c\x00", 1024) = 4 [pid 5229] <... madvise resumed>) = 0 [pid 5239] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x0e\xfc", iov_len=2}, {iov_base="\x01\x38\x0c", iov_len=3}, {iov_base="\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., iov_len=249}], 4 [pid 5223] ioctl(3, HCISETSCAN [pid 5229] exit(0 [pid 5220] unshare(CLONE_SYSVSEM [pid 5221] <... ioctl resumed>, 0x7fff61787a40) = 0 [pid 5220] <... unshare resumed>) = 0 [pid 5239] <... writev resumed>) = 255 [pid 5238] <... read resumed>"\x01\x1a\x0c\x01\x02", 1024) = 5 [pid 5229] <... exit resumed>) = ? [pid 5218] unshare(CLONE_NEWIPC [pid 5220] openat(AT_FDCWD, "/proc/sys/kernel/shmmax", O_WRONLY|O_CLOEXEC [pid 5221] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x04\x0a", iov_len=2}, {iov_base="\xaa\xaa\xaa\xaa\xaa\x10\x00\x00\x00\x01", iov_len=10}], 3) = 13 [pid 5221] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x03\x0b", iov_len=2}, {iov_base="\x00\xc8\x00\xaa\xaa\xaa\xaa\xaa\x10\x01\x00", iov_len=11}], 3) = 14 [pid 5221] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\v\v", iov_len=2}, {iov_base="\x00\xc8\x00\x00\x00\x00\x00\x00\x00\x00\x00", iov_len=11}], 3 [pid 5220] <... openat resumed>) = 3 [pid 5229] +++ exited with 0 +++ [pid 5221] <... writev resumed>) = 14 [pid 5221] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x3e\x13", iov_len=2}, {iov_base="\x01\x00\xc9\x00\x01\x00\xaa\xaa\xaa\xaa\xaa\x11\x00\x00\x00\x00\x00\x00\x00", iov_len=19}], 3) = 22 [pid 5221] close(3 [pid 5238] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x0e\x04", iov_len=2}, {iov_base="\x01\x1a\x0c", iov_len=3}, {iov_base="\x00", iov_len=1}], 4 [pid 5221] <... close resumed>) = 0 [pid 5238] <... writev resumed>) = 7 [pid 5238] rt_sigprocmask(SIG_BLOCK, ~[RT_1], [pid 5223] <... ioctl resumed>, 0x7fff61787a40) = 0 [pid 5221] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5238] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5223] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x04\x0a", iov_len=2}, {iov_base="\xaa\xaa\xaa\xaa\xaa\x10\x00\x00\x00\x01", iov_len=10}], 3 [pid 5221] <... prctl resumed>) = 0 [pid 5220] write(3, "16777216", 8 [pid 5238] madvise(0x7f0b64a00000, 8372224, MADV_DONTNEED [pid 5223] <... writev resumed>) = 13 [pid 5221] setsid( [pid 5220] <... write resumed>) = 8 [pid 5218] <... unshare resumed>) = 0 [pid 5223] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x03\x0b", iov_len=2}, {iov_base="\x00\xc8\x00\xaa\xaa\xaa\xaa\xaa\x10\x01\x00", iov_len=11}], 3 [pid 5220] close(3 [pid 5238] <... madvise resumed>) = 0 [pid 5223] <... writev resumed>) = 14 [pid 5221] <... setsid resumed>) = 1 [pid 5220] <... close resumed>) = 0 [pid 5239] read(202, [pid 5238] exit(0 [pid 5221] openat(AT_FDCWD, "/proc/self/ns/net", O_RDONLY [pid 5239] <... read resumed>"\x01\x39\x0c\x00", 1024) = 4 [pid 5238] <... exit resumed>) = ? [pid 5221] <... openat resumed>) = 3 [ 78.826327][ T29] audit: type=1400 audit(1724634685.411:96): avc: denied { open } for pid=5218 comm="syz-executor254" path="net:[4026531840]" dev="nsfs" ino=4026531840 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 78.855380][ T54] Bluetooth: hci4: unexpected cc 0x0c25 length: 249 > 3 [ 78.865078][ T54] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [pid 5218] unshare(CLONE_NEWCGROUP [pid 5239] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x0e\xfc", iov_len=2}, {iov_base="\x01\x39\x0c", iov_len=3}, {iov_base="\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., iov_len=249}], 4 [pid 5238] +++ exited with 0 +++ [pid 5221] dup2(3, 201 [pid 5239] <... writev resumed>) = 255 [pid 5218] <... unshare resumed>) = 0 [pid 5221] <... dup2 resumed>) = 201 [pid 5221] close(3) = 0 [pid 5221] prlimit64(0, RLIMIT_AS, {rlim_cur=204800*1024, rlim_max=204800*1024}, NULL) = 0 [pid 5221] prlimit64(0, RLIMIT_MEMLOCK, {rlim_cur=32768*1024, rlim_max=32768*1024}, [pid 5239] read(202, [pid 5221] <... prlimit64 resumed>NULL) = 0 [pid 5218] unshare(CLONE_NEWUTS [pid 5221] prlimit64(0, RLIMIT_FSIZE, {rlim_cur=139264*1024, rlim_max=139264*1024}, [pid 5218] <... unshare resumed>) = 0 [pid 5221] <... prlimit64 resumed>NULL) = 0 [pid 5218] unshare(CLONE_SYSVSEM [pid 5221] prlimit64(0, RLIMIT_STACK, {rlim_cur=1024*1024, rlim_max=1024*1024}, [pid 5218] <... unshare resumed>) = 0 [pid 5221] <... prlimit64 resumed>NULL) = 0 [pid 5218] openat(AT_FDCWD, "/proc/sys/kernel/shmmax", O_WRONLY|O_CLOEXEC [pid 5221] prlimit64(0, RLIMIT_CORE, {rlim_cur=131072*1024, rlim_max=131072*1024}, [pid 5218] <... openat resumed>) = 3 [pid 5221] <... prlimit64 resumed>NULL) = 0 [pid 5221] prlimit64(0, RLIMIT_NOFILE, {rlim_cur=256, rlim_max=256}, NULL) = 0 [pid 5218] write(3, "16777216", 8 [pid 5239] <... read resumed>"\x01\x16\x0c\x02\x00\x7d", 1024) = 6 [pid 5223] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\v\v", iov_len=2}, {iov_base="\x00\xc8\x00\x00\x00\x00\x00\x00\x00\x00\x00", iov_len=11}], 3 [pid 5220] openat(AT_FDCWD, "/proc/sys/kernel/shmall", O_WRONLY|O_CLOEXEC [pid 5239] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x0e\xfc", iov_len=2}, {iov_base="\x01\x16\x0c", iov_len=3}, {iov_base="\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., iov_len=249}], 4 [pid 5223] <... writev resumed>) = 14 [pid 5221] unshare(CLONE_NEWNS [pid 5220] <... openat resumed>) = 3 [pid 5218] <... write resumed>) = 8 [pid 5239] <... writev resumed>) = 255 [pid 5239] read(202, [pid 5220] write(3, "536870912", 9 [pid 5222] <... ioctl resumed>, 0x4) = -1 EALREADY (Operation already in progress) [pid 5220] <... write resumed>) = 9 [pid 5222] ioctl(3, HCISETSCAN [pid 5220] close(3 [pid 5218] close(3 [pid 5223] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x3e\x13", iov_len=2}, {iov_base="\x01\x00\xc9\x00\x01\x00\xaa\xaa\xaa\xaa\xaa\x11\x00\x00\x00\x00\x00\x00\x00", iov_len=19}], 3 [pid 5220] <... close resumed>) = 0 [pid 5218] <... close resumed>) = 0 [pid 5223] <... writev resumed>) = 22 [pid 5220] openat(AT_FDCWD, "/proc/sys/kernel/shmmni", O_WRONLY|O_CLOEXEC [pid 5221] <... unshare resumed>) = 0 [pid 5220] <... openat resumed>) = 3 [pid 5223] close(3 [pid 5218] openat(AT_FDCWD, "/proc/sys/kernel/shmall", O_WRONLY|O_CLOEXEC [pid 5220] write(3, "1024", 4 [pid 5223] <... close resumed>) = 0 [pid 5220] <... write resumed>) = 4 [pid 5221] mount(NULL, "/", NULL, MS_REC|MS_PRIVATE, NULL [pid 5218] <... openat resumed>) = 3 [pid 5239] <... read resumed>"\x01\x1a\x0c\x01\x02", 1024) = 5 [pid 5223] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5220] close(3 [pid 5239] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x0e\x04", iov_len=2}, {iov_base="\x01\x1a\x0c", iov_len=3}, {iov_base="\x00", iov_len=1}], 4 [pid 5221] <... mount resumed>) = 0 [pid 5218] write(3, "536870912", 9 [pid 5239] <... writev resumed>) = 7 [pid 5222] <... ioctl resumed>, 0x7fff61787a40) = 0 [pid 5239] rt_sigprocmask(SIG_BLOCK, ~[RT_1], [pid 5223] <... prctl resumed>) = 0 [pid 5222] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x04\x0a", iov_len=2}, {iov_base="\xaa\xaa\xaa\xaa\xaa\x10\x00\x00\x00\x01", iov_len=10}], 3 [pid 5220] <... close resumed>) = 0 [pid 5239] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5223] setsid( [pid 5222] <... writev resumed>) = 13 [pid 5221] unshare(CLONE_NEWIPC [pid 5220] openat(AT_FDCWD, "/proc/sys/kernel/msgmax", O_WRONLY|O_CLOEXEC [pid 5218] <... write resumed>) = 9 [pid 5239] madvise(0x7f0b64a00000, 8372224, MADV_DONTNEED [pid 5222] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x03\x0b", iov_len=2}, {iov_base="\x00\xc8\x00\xaa\xaa\xaa\xaa\xaa\x10\x01\x00", iov_len=11}], 3 [pid 5239] <... madvise resumed>) = 0 [pid 5222] <... writev resumed>) = 14 [pid 5239] exit(0 [pid 5222] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\v\v", iov_len=2}, {iov_base="\x00\xc8\x00\x00\x00\x00\x00\x00\x00\x00\x00", iov_len=11}], 3 [pid 5220] <... openat resumed>) = 3 [pid 5239] <... exit resumed>) = ? [pid 5222] <... writev resumed>) = 14 [pid 5239] +++ exited with 0 +++ [pid 5222] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x3e\x13", iov_len=2}, {iov_base="\x01\x00\xc9\x00\x01\x00\xaa\xaa\xaa\xaa\xaa\x11\x00\x00\x00\x00\x00\x00\x00", iov_len=19}], 3) = 22 [pid 5222] close(3) = 0 [pid 5222] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5222] setsid() = 1 [pid 5222] openat(AT_FDCWD, "/proc/self/ns/net", O_RDONLY) = 3 [pid 5222] dup2(3, 201) = 201 [pid 5222] close(3) = 0 [pid 5222] prlimit64(0, RLIMIT_AS, {rlim_cur=204800*1024, rlim_max=204800*1024}, NULL) = 0 [pid 5223] <... setsid resumed>) = 1 [pid 5222] prlimit64(0, RLIMIT_MEMLOCK, {rlim_cur=32768*1024, rlim_max=32768*1024}, [pid 5218] close(3 [pid 5222] <... prlimit64 resumed>NULL) = 0 [pid 5223] openat(AT_FDCWD, "/proc/self/ns/net", O_RDONLY [pid 5222] prlimit64(0, RLIMIT_FSIZE, {rlim_cur=139264*1024, rlim_max=139264*1024}, [pid 5220] write(3, "8192", 4 [pid 5218] <... close resumed>) = 0 [pid 5222] <... prlimit64 resumed>NULL) = 0 [pid 5222] prlimit64(0, RLIMIT_STACK, {rlim_cur=1024*1024, rlim_max=1024*1024}, [pid 5218] openat(AT_FDCWD, "/proc/sys/kernel/shmmni", O_WRONLY|O_CLOEXEC [pid 5222] <... prlimit64 resumed>NULL) = 0 [pid 5220] <... write resumed>) = 4 [pid 5222] prlimit64(0, RLIMIT_CORE, {rlim_cur=131072*1024, rlim_max=131072*1024}, NULL) = 0 [pid 5220] close(3 [pid 5222] prlimit64(0, RLIMIT_NOFILE, {rlim_cur=256, rlim_max=256}, NULL) = 0 [pid 5222] unshare(CLONE_NEWNS) = 0 [pid 5220] <... close resumed>) = 0 [pid 5218] <... openat resumed>) = 3 [pid 5222] mount(NULL, "/", NULL, MS_REC|MS_PRIVATE, NULL [pid 5223] <... openat resumed>) = 3 [pid 5222] <... mount resumed>) = 0 [pid 5221] <... unshare resumed>) = 0 [pid 5220] openat(AT_FDCWD, "/proc/sys/kernel/msgmni", O_WRONLY|O_CLOEXEC [pid 5222] unshare(CLONE_NEWIPC) = 0 [pid 5220] <... openat resumed>) = 3 [pid 5222] unshare(CLONE_NEWCGROUP) = 0 [pid 5220] write(3, "1024", 4 [pid 5223] dup2(3, 201 [pid 5222] unshare(CLONE_NEWUTS [pid 5220] <... write resumed>) = 4 [pid 5222] <... unshare resumed>) = 0 [pid 5223] <... dup2 resumed>) = 201 [pid 5222] unshare(CLONE_SYSVSEM [pid 5221] unshare(CLONE_NEWCGROUP [pid 5220] close(3 [pid 5218] write(3, "1024", 4 [pid 5223] close(3 [pid 5221] <... unshare resumed>) = 0 [pid 5223] <... close resumed>) = 0 [pid 5218] <... write resumed>) = 4 [pid 5221] unshare(CLONE_NEWUTS [pid 5223] prlimit64(0, RLIMIT_AS, {rlim_cur=204800*1024, rlim_max=204800*1024}, [pid 5218] close(3 [pid 5223] <... prlimit64 resumed>NULL) = 0 [pid 5221] <... unshare resumed>) = 0 [pid 5223] prlimit64(0, RLIMIT_MEMLOCK, {rlim_cur=32768*1024, rlim_max=32768*1024}, [pid 5221] unshare(CLONE_SYSVSEM [pid 5218] <... close resumed>) = 0 [pid 5223] <... prlimit64 resumed>NULL) = 0 [pid 5221] <... unshare resumed>) = 0 [pid 5218] openat(AT_FDCWD, "/proc/sys/kernel/msgmax", O_WRONLY|O_CLOEXEC [pid 5223] prlimit64(0, RLIMIT_FSIZE, {rlim_cur=139264*1024, rlim_max=139264*1024}, NULL) = 0 [pid 5222] <... unshare resumed>) = 0 [pid 5221] openat(AT_FDCWD, "/proc/sys/kernel/shmmax", O_WRONLY|O_CLOEXEC [pid 5220] <... close resumed>) = 0 [pid 5218] <... openat resumed>) = 3 [pid 5223] prlimit64(0, RLIMIT_STACK, {rlim_cur=1024*1024, rlim_max=1024*1024}, [pid 5222] openat(AT_FDCWD, "/proc/sys/kernel/shmmax", O_WRONLY|O_CLOEXEC [pid 5220] openat(AT_FDCWD, "/proc/sys/kernel/msgmnb", O_WRONLY|O_CLOEXEC [pid 5223] <... prlimit64 resumed>NULL) = 0 [pid 5222] <... openat resumed>) = 3 [pid 5221] <... openat resumed>) = 3 [pid 5220] <... openat resumed>) = 3 [pid 5218] write(3, "8192", 4 [pid 5223] prlimit64(0, RLIMIT_CORE, {rlim_cur=131072*1024, rlim_max=131072*1024}, [pid 5222] write(3, "16777216", 8 [pid 5220] write(3, "1024", 4 [pid 5223] <... prlimit64 resumed>NULL) = 0 [pid 5222] <... write resumed>) = 8 [pid 5221] write(3, "16777216", 8 [pid 5220] <... write resumed>) = 4 [pid 5218] <... write resumed>) = 4 [pid 5223] prlimit64(0, RLIMIT_NOFILE, {rlim_cur=256, rlim_max=256}, [pid 5222] close(3 [pid 5220] close(3 [pid 5223] <... prlimit64 resumed>NULL) = 0 [pid 5222] <... close resumed>) = 0 [pid 5221] <... write resumed>) = 8 [pid 5218] close(3 [pid 5223] unshare(CLONE_NEWNS [pid 5222] openat(AT_FDCWD, "/proc/sys/kernel/shmall", O_WRONLY|O_CLOEXEC [pid 5221] close(3 [pid 5220] <... close resumed>) = 0 [pid 5218] <... close resumed>) = 0 [pid 5222] <... openat resumed>) = 3 [pid 5220] openat(AT_FDCWD, "/proc/sys/kernel/sem", O_WRONLY|O_CLOEXEC [pid 5223] <... unshare resumed>) = 0 [pid 5221] <... close resumed>) = 0 [pid 5220] <... openat resumed>) = 3 [pid 5218] openat(AT_FDCWD, "/proc/sys/kernel/msgmni", O_WRONLY|O_CLOEXEC [pid 5223] mount(NULL, "/", NULL, MS_REC|MS_PRIVATE, NULL [pid 5221] openat(AT_FDCWD, "/proc/sys/kernel/shmall", O_WRONLY|O_CLOEXEC [pid 5223] <... mount resumed>) = 0 [pid 5222] write(3, "536870912", 9 [pid 5220] write(3, "1024 1048576 500 1024", 21 [pid 5218] <... openat resumed>) = 3 [pid 5223] unshare(CLONE_NEWIPC [pid 5222] <... write resumed>) = 9 [pid 5221] <... openat resumed>) = 3 [pid 5222] close(3 [pid 5221] write(3, "536870912", 9 [pid 5220] <... write resumed>) = 21 [pid 5218] write(3, "1024", 4 [pid 5223] <... unshare resumed>) = 0 [pid 5222] <... close resumed>) = 0 [pid 5221] <... write resumed>) = 9 [pid 5223] unshare(CLONE_NEWCGROUP [pid 5222] openat(AT_FDCWD, "/proc/sys/kernel/shmmni", O_WRONLY|O_CLOEXEC [pid 5220] close(3 [pid 5218] <... write resumed>) = 4 [pid 5223] <... unshare resumed>) = 0 [pid 5222] <... openat resumed>) = 3 [pid 5221] close(3 [pid 5220] <... close resumed>) = 0 [pid 5223] unshare(CLONE_NEWUTS [pid 5221] <... close resumed>) = 0 [pid 5220] getpid( [pid 5218] close(3 [pid 5222] write(3, "1024", 4 [pid 5220] <... getpid resumed>) = 1 [ 78.880408][ T29] audit: type=1400 audit(1724634685.451:97): avc: denied { mounton } for pid=5220 comm="syz-executor254" path="/" dev="sda1" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:root_t tclass=dir permissive=1 [pid 5223] <... unshare resumed>) = 0 [pid 5222] <... write resumed>) = 4 [pid 5221] openat(AT_FDCWD, "/proc/sys/kernel/shmmni", O_WRONLY|O_CLOEXEC [pid 5220] capget({version=_LINUX_CAPABILITY_VERSION_3, pid=1}, [pid 5218] <... close resumed>) = 0 [pid 5223] unshare(CLONE_SYSVSEM [pid 5220] <... capget resumed>{effective=1<) = 0 [pid 5222] close(3 [pid 5221] <... openat resumed>) = 3 [pid 5220] capset({version=_LINUX_CAPABILITY_VERSION_3, pid=1}, {effective=1< [pid 5218] openat(AT_FDCWD, "/proc/sys/kernel/msgmnb", O_WRONLY|O_CLOEXEC [pid 5223] openat(AT_FDCWD, "/proc/sys/kernel/shmmax", O_WRONLY|O_CLOEXEC [pid 5222] <... close resumed>) = 0 [pid 5220] <... capset resumed>) = 0 [pid 5218] <... openat resumed>) = 3 [pid 5220] unshare(CLONE_NEWNET [pid 5223] <... openat resumed>) = 3 [pid 5222] openat(AT_FDCWD, "/proc/sys/kernel/msgmax", O_WRONLY|O_CLOEXEC [pid 5221] write(3, "1024", 4 [pid 5218] write(3, "1024", 4 [pid 5223] write(3, "16777216", 8 [pid 5221] <... write resumed>) = 4 [pid 5218] <... write resumed>) = 4 [pid 5223] <... write resumed>) = 8 [pid 5221] close(3 [pid 5218] close(3 [pid 5223] close(3 [pid 5221] <... close resumed>) = 0 [pid 5218] <... close resumed>) = 0 [pid 5223] <... close resumed>) = 0 [pid 5221] openat(AT_FDCWD, "/proc/sys/kernel/msgmax", O_WRONLY|O_CLOEXEC [pid 5218] openat(AT_FDCWD, "/proc/sys/kernel/sem", O_WRONLY|O_CLOEXEC [pid 5223] openat(AT_FDCWD, "/proc/sys/kernel/shmall", O_WRONLY|O_CLOEXEC) = 3 [pid 5222] <... openat resumed>) = 3 [pid 5221] <... openat resumed>) = 3 [pid 5218] <... openat resumed>) = 3 [pid 5222] write(3, "8192", 4) = 4 [pid 5222] close(3) = 0 [pid 5222] openat(AT_FDCWD, "/proc/sys/kernel/msgmni", O_WRONLY|O_CLOEXEC [pid 5223] write(3, "536870912", 9 [pid 5222] <... openat resumed>) = 3 [pid 5221] write(3, "8192", 4 [pid 5218] write(3, "1024 1048576 500 1024", 21 [pid 5223] <... write resumed>) = 9 [pid 5221] <... write resumed>) = 4 [pid 5223] close(3 [pid 5218] <... write resumed>) = 21 [pid 5221] close(3 [pid 5223] <... close resumed>) = 0 [pid 5218] close(3 [pid 5223] openat(AT_FDCWD, "/proc/sys/kernel/shmmni", O_WRONLY|O_CLOEXEC [pid 5221] <... close resumed>) = 0 [pid 5218] <... close resumed>) = 0 [pid 5223] <... openat resumed>) = 3 [pid 5221] openat(AT_FDCWD, "/proc/sys/kernel/msgmni", O_WRONLY|O_CLOEXEC [pid 5218] getpid( [pid 5222] write(3, "1024", 4 [pid 5218] <... getpid resumed>) = 1 [pid 5222] <... write resumed>) = 4 [pid 5218] capget({version=_LINUX_CAPABILITY_VERSION_3, pid=1}, [pid 5222] close(3 [pid 5223] write(3, "1024", 4 [pid 5218] <... capget resumed>{effective=1<) = 4 [pid 5221] <... openat resumed>) = 3 [pid 5218] capset({version=_LINUX_CAPABILITY_VERSION_3, pid=1}, {effective=1< [pid 5223] close(3 [pid 5221] write(3, "1024", 4 [pid 5223] <... close resumed>) = 0 [pid 5218] <... capset resumed>) = 0 [pid 5223] openat(AT_FDCWD, "/proc/sys/kernel/msgmax", O_WRONLY|O_CLOEXEC [pid 5221] <... write resumed>) = 4 [pid 5218] unshare(CLONE_NEWNET [pid 5223] <... openat resumed>) = 3 [pid 5222] <... close resumed>) = 0 [pid 5221] close(3 [pid 5222] openat(AT_FDCWD, "/proc/sys/kernel/msgmnb", O_WRONLY|O_CLOEXEC) = 3 [pid 5222] write(3, "1024", 4) = 4 [pid 5222] close(3) = 0 [pid 5222] openat(AT_FDCWD, "/proc/sys/kernel/sem", O_WRONLY|O_CLOEXEC) = 3 [pid 5221] <... close resumed>) = 0 [pid 5223] write(3, "8192", 4 [pid 5221] openat(AT_FDCWD, "/proc/sys/kernel/msgmnb", O_WRONLY|O_CLOEXEC [pid 5223] <... write resumed>) = 4 [pid 5223] close(3 [pid 5222] write(3, "1024 1048576 500 1024", 21 [pid 5221] <... openat resumed>) = 3 [pid 5223] <... close resumed>) = 0 [pid 5222] <... write resumed>) = 21 [pid 5221] write(3, "1024", 4 [pid 5223] openat(AT_FDCWD, "/proc/sys/kernel/msgmni", O_WRONLY|O_CLOEXEC [pid 5221] <... write resumed>) = 4 [pid 5223] <... openat resumed>) = 3 [pid 5222] close(3 [pid 5221] close(3 [pid 5223] write(3, "1024", 4 [pid 5222] <... close resumed>) = 0 [pid 5222] getpid( [pid 5221] <... close resumed>) = 0 [pid 5223] <... write resumed>) = 4 [pid 5222] <... getpid resumed>) = 1 [pid 5223] close(3 [pid 5222] capget({version=_LINUX_CAPABILITY_VERSION_3, pid=1}, [pid 5223] <... close resumed>) = 0 [pid 5222] <... capget resumed>{effective=1< [pid 5223] openat(AT_FDCWD, "/proc/sys/kernel/msgmnb", O_WRONLY|O_CLOEXEC) = 3 [pid 5222] capset({version=_LINUX_CAPABILITY_VERSION_3, pid=1}, {effective=1< [pid 5221] <... openat resumed>) = 3 [pid 5223] write(3, "1024", 4 [pid 5221] write(3, "1024 1048576 500 1024", 21 [pid 5223] <... write resumed>) = 4 [pid 5221] <... write resumed>) = 21 [pid 5223] close(3 [pid 5221] close(3 [pid 5223] <... close resumed>) = 0 [pid 5221] <... close resumed>) = 0 [pid 5223] openat(AT_FDCWD, "/proc/sys/kernel/sem", O_WRONLY|O_CLOEXEC [pid 5221] getpid( [pid 5222] <... capset resumed>) = 0 [pid 5223] <... openat resumed>) = 3 [pid 5221] <... getpid resumed>) = 1 [pid 5223] write(3, "1024 1048576 500 1024", 21 [pid 5221] capget({version=_LINUX_CAPABILITY_VERSION_3, pid=1}, [pid 5223] <... write resumed>) = 21 [pid 5221] <... capget resumed>{effective=1< [pid 5221] capset({version=_LINUX_CAPABILITY_VERSION_3, pid=1}, {effective=1< [pid 5223] <... close resumed>) = 0 [pid 5221] <... capset resumed>) = 0 [pid 5223] getpid( [pid 5221] unshare(CLONE_NEWNET [pid 5223] <... getpid resumed>) = 1 [pid 5223] capget({version=_LINUX_CAPABILITY_VERSION_3, pid=1}, [pid 5222] unshare(CLONE_NEWNET [pid 5223] <... capget resumed>{effective=1< [pid 5221] <... unshare resumed>) = 0 [pid 5221] openat(AT_FDCWD, "/proc/sys/net/ipv4/ping_group_range", O_WRONLY|O_CLOEXEC) = 3 [pid 5221] write(3, "0 65535", 7) = 7 [pid 5221] close(3) = 0 [pid 5221] openat(AT_FDCWD, "/dev/net/tun", O_RDWR|O_NONBLOCK [pid 5220] <... unshare resumed>) = 0 [pid 5221] <... openat resumed>) = 3 [pid 5220] openat(AT_FDCWD, "/proc/sys/net/ipv4/ping_group_range", O_WRONLY|O_CLOEXEC [pid 5221] dup2(3, 200) = 200 [pid 5221] close(3) = 0 [pid 5221] ioctl(200, TUNSETIFF, 0x7fff61787ad0 [pid 5220] <... openat resumed>) = 3 [pid 5220] write(3, "0 65535", 7) = 7 [pid 5220] close(3) = 0 [pid 5220] openat(AT_FDCWD, "/dev/net/tun", O_RDWR|O_NONBLOCK) = 3 [pid 5220] dup2(3, 200) = 200 [pid 5220] close(3) = 0 [pid 5220] ioctl(200, TUNSETIFF, 0x7fff61787ad0 [pid 5223] <... unshare resumed>) = 0 [pid 5223] openat(AT_FDCWD, "/proc/sys/net/ipv4/ping_group_range", O_WRONLY|O_CLOEXEC) = 3 [pid 5223] write(3, "0 65535", 7) = 7 [pid 5223] close(3) = 0 [pid 5223] openat(AT_FDCWD, "/dev/net/tun", O_RDWR|O_NONBLOCK) = 3 [pid 5223] dup2(3, 200) = 200 [pid 5223] close(3) = 0 [pid 5223] ioctl(200, TUNSETIFF, 0x7fff61787ad0 [pid 5218] <... unshare resumed>) = 0 [pid 5223] <... ioctl resumed>) = 0 [pid 5221] <... ioctl resumed>) = 0 [pid 5218] openat(AT_FDCWD, "/proc/sys/net/ipv4/ping_group_range", O_WRONLY|O_CLOEXEC) = 3 [pid 5218] write(3, "0 65535", 7) = 7 [pid 5218] close(3) = 0 [pid 5218] openat(AT_FDCWD, "/dev/net/tun", O_RDWR|O_NONBLOCK [pid 5221] openat(AT_FDCWD, "/proc/sys/net/ipv6/conf/syz_tun/accept_dad", O_WRONLY|O_CLOEXEC [pid 5218] <... openat resumed>) = 3 [pid 5221] <... openat resumed>) = 3 [pid 5218] dup2(3, 200) = 200 [pid 5218] close(3) = 0 [pid 5218] ioctl(200, TUNSETIFF, 0x7fff61787ad0 [pid 5221] write(3, "0", 1 [pid 5220] <... ioctl resumed>) = 0 [pid 5218] <... ioctl resumed>) = 0 [pid 5221] <... write resumed>) = 1 [pid 5221] close(3 [pid 5220] openat(AT_FDCWD, "/proc/sys/net/ipv6/conf/syz_tun/accept_dad", O_WRONLY|O_CLOEXEC [pid 5223] openat(AT_FDCWD, "/proc/sys/net/ipv6/conf/syz_tun/accept_dad", O_WRONLY|O_CLOEXEC) = 3 [pid 5221] <... close resumed>) = 0 [pid 5223] write(3, "0", 1) = 1 [pid 5223] close(3) = 0 [pid 5223] openat(AT_FDCWD, "/proc/sys/net/ipv6/conf/syz_tun/router_solicitations", O_WRONLY|O_CLOEXEC) = 3 [pid 5221] openat(AT_FDCWD, "/proc/sys/net/ipv6/conf/syz_tun/router_solicitations", O_WRONLY|O_CLOEXEC [pid 5220] <... openat resumed>) = 3 [pid 5221] <... openat resumed>) = 3 [pid 5223] write(3, "0", 1) = 1 [pid 5222] <... unshare resumed>) = 0 [pid 5221] write(3, "0", 1 [pid 5220] write(3, "0", 1 [pid 5218] openat(AT_FDCWD, "/proc/sys/net/ipv6/conf/syz_tun/accept_dad", O_WRONLY|O_CLOEXEC [pid 5223] close(3 [pid 5222] openat(AT_FDCWD, "/proc/sys/net/ipv4/ping_group_range", O_WRONLY|O_CLOEXEC [pid 5221] <... write resumed>) = 1 [pid 5218] <... openat resumed>) = 3 [pid 5223] <... close resumed>) = 0 [pid 5222] <... openat resumed>) = 3 [pid 5223] socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE [pid 5221] close(3 [pid 5220] <... write resumed>) = 1 [pid 5221] <... close resumed>) = 0 [pid 5220] close(3 [pid 5221] socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE [pid 5220] <... close resumed>) = 0 [pid 5223] <... socket resumed>) = 3 [pid 5222] write(3, "0 65535", 7 [pid 5221] <... socket resumed>) = 3 [pid 5220] openat(AT_FDCWD, "/proc/sys/net/ipv6/conf/syz_tun/router_solicitations", O_WRONLY|O_CLOEXEC [pid 5223] socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0 [pid 5222] <... write resumed>) = 7 [pid 5218] write(3, "0", 1 [pid 5223] <... socket resumed>) = 4 [pid 5222] close(3 [pid 5220] <... openat resumed>) = 3 [pid 5222] <... close resumed>) = 0 [pid 5221] socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0 [pid 5220] write(3, "0", 1 [pid 5218] <... write resumed>) = 1 [pid 5223] ioctl(4, SIOCGIFINDEX, {ifr_name="syz_tun" [pid 5222] openat(AT_FDCWD, "/dev/net/tun", O_RDWR|O_NONBLOCK [pid 5220] <... write resumed>) = 1 [pid 5218] close(3 [pid 5223] <... ioctl resumed>, ifr_ifindex=11}) = 0 [pid 5222] <... openat resumed>) = 3 [pid 5221] <... socket resumed>) = 4 [pid 5218] <... close resumed>) = 0 [pid 5218] openat(AT_FDCWD, "/proc/sys/net/ipv6/conf/syz_tun/router_solicitations", O_WRONLY|O_CLOEXEC [pid 5220] close(3 [pid 5221] ioctl(4, SIOCGIFINDEX, {ifr_name="syz_tun" [pid 5220] <... close resumed>) = 0 [pid 5220] socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE [pid 5221] <... ioctl resumed>, ifr_ifindex=11}) = 0 [pid 5223] close(4 [pid 5221] close(4 [pid 5223] <... close resumed>) = 0 [pid 5222] dup2(3, 200 [pid 5220] <... socket resumed>) = 3 [pid 5218] <... openat resumed>) = 3 [pid 5223] sendto(3, [{nlmsg_len=40, nlmsg_type=0x14 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x500, nlmsg_seq=0, nlmsg_pid=0}, "\x02\x18\x00\x00\x0b\x00\x00\x00\x08\x00\x02\x00\xac\x14\x14\xaa\x08\x00\x01\x00\xac\x14\x14\xaa"], 40, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 [pid 5222] <... dup2 resumed>) = 200 [pid 5221] <... close resumed>) = 0 [pid 5220] socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0 [pid 5222] close(3 [pid 5218] write(3, "0", 1 [pid 5223] <... sendto resumed>) = 40 [pid 5222] <... close resumed>) = 0 [pid 5221] sendto(3, [{nlmsg_len=40, nlmsg_type=0x14 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x500, nlmsg_seq=0, nlmsg_pid=0}, "\x02\x18\x00\x00\x0b\x00\x00\x00\x08\x00\x02\x00\xac\x14\x14\xaa\x08\x00\x01\x00\xac\x14\x14\xaa"], 40, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 [pid 5220] <... socket resumed>) = 4 [pid 5218] <... write resumed>) = 1 [pid 5223] recvfrom(3, [pid 5222] ioctl(200, TUNSETIFF, 0x7fff61787ad0 [pid 5218] close(3 [pid 5223] <... recvfrom resumed>[{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=1}, {error=0, msg={nlmsg_len=40, nlmsg_type=0x14 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x500, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36 [pid 5222] <... ioctl resumed>) = 0 [pid 5220] ioctl(4, SIOCGIFINDEX, {ifr_name="syz_tun" [pid 5218] <... close resumed>) = 0 [pid 5223] socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0 [pid 5221] <... sendto resumed>) = 40 [pid 5218] socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE [pid 5221] recvfrom(3, [pid 5220] <... ioctl resumed>, ifr_ifindex=11}) = 0 [pid 5218] <... socket resumed>) = 3 [pid 5221] <... recvfrom resumed>[{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=1}, {error=0, msg={nlmsg_len=40, nlmsg_type=0x14 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x500, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36 [pid 5220] close(4 [pid 5221] socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0 [pid 5223] <... socket resumed>) = 4 [pid 5220] <... close resumed>) = 0 [pid 5218] socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0 [pid 5223] ioctl(4, SIOCGIFINDEX, {ifr_name="syz_tun" [pid 5221] <... socket resumed>) = 4 [pid 5220] sendto(3, [{nlmsg_len=40, nlmsg_type=0x14 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x500, nlmsg_seq=0, nlmsg_pid=0}, "\x02\x18\x00\x00\x0b\x00\x00\x00\x08\x00\x02\x00\xac\x14\x14\xaa\x08\x00\x01\x00\xac\x14\x14\xaa"], 40, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 [pid 5218] <... socket resumed>) = 4 [pid 5223] <... ioctl resumed>, ifr_ifindex=11}) = 0 [pid 5222] openat(AT_FDCWD, "/proc/sys/net/ipv6/conf/syz_tun/accept_dad", O_WRONLY|O_CLOEXEC [pid 5221] ioctl(4, SIOCGIFINDEX, {ifr_name="syz_tun" [pid 5218] ioctl(4, SIOCGIFINDEX, {ifr_name="syz_tun" [pid 5223] close(4 [pid 5222] <... openat resumed>) = 3 [pid 5221] <... ioctl resumed>, ifr_ifindex=11}) = 0 [pid 5220] <... sendto resumed>) = 40 [pid 5218] <... ioctl resumed>, ifr_ifindex=11}) = 0 [pid 5223] <... close resumed>) = 0 [pid 5222] write(3, "0", 1 [pid 5221] close(4 [pid 5220] recvfrom(3, [pid 5218] close(4 [pid 5223] sendto(3, [{nlmsg_len=64, nlmsg_type=0x14 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x500, nlmsg_seq=0, nlmsg_pid=0}, "\x0a\x78\x00\x00\x0b\x00\x00\x00\x14\x00\x02\x00\xfe\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xaa\x14\x00\x01\x00\xfe\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xaa"], 64, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 [pid 5222] <... write resumed>) = 1 [pid 5221] <... close resumed>) = 0 [pid 5220] <... recvfrom resumed>[{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=1}, {error=0, msg={nlmsg_len=40, nlmsg_type=0x14 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x500, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36 [pid 5218] <... close resumed>) = 0 [pid 5223] <... sendto resumed>) = 64 [pid 5222] close(3 [pid 5221] sendto(3, [{nlmsg_len=64, nlmsg_type=0x14 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x500, nlmsg_seq=0, nlmsg_pid=0}, "\x0a\x78\x00\x00\x0b\x00\x00\x00\x14\x00\x02\x00\xfe\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xaa\x14\x00\x01\x00\xfe\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xaa"], 64, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 [pid 5220] socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0 [pid 5218] sendto(3, [{nlmsg_len=40, nlmsg_type=0x14 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x500, nlmsg_seq=0, nlmsg_pid=0}, "\x02\x18\x00\x00\x0b\x00\x00\x00\x08\x00\x02\x00\xac\x14\x14\xaa\x08\x00\x01\x00\xac\x14\x14\xaa"], 40, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 [pid 5223] recvfrom(3, [pid 5222] <... close resumed>) = 0 [pid 5221] <... sendto resumed>) = 64 [pid 5220] <... socket resumed>) = 4 [pid 5218] <... sendto resumed>) = 40 [pid 5223] <... recvfrom resumed>[{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=1}, {error=0, msg={nlmsg_len=64, nlmsg_type=0x14 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x500, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36 [pid 5222] openat(AT_FDCWD, "/proc/sys/net/ipv6/conf/syz_tun/router_solicitations", O_WRONLY|O_CLOEXEC [pid 5218] recvfrom(3, [pid 5223] socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0 [pid 5222] <... openat resumed>) = 3 [pid 5221] recvfrom(3, [pid 5220] ioctl(4, SIOCGIFINDEX, {ifr_name="syz_tun" [pid 5218] <... recvfrom resumed>[{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=1}, {error=0, msg={nlmsg_len=40, nlmsg_type=0x14 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x500, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36 [pid 5223] <... socket resumed>) = 4 [pid 5222] write(3, "0", 1 [pid 5221] <... recvfrom resumed>[{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=1}, {error=0, msg={nlmsg_len=64, nlmsg_type=0x14 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x500, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36 [pid 5220] <... ioctl resumed>, ifr_ifindex=11}) = 0 [pid 5218] socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0 [pid 5223] ioctl(4, SIOCGIFINDEX, {ifr_name="syz_tun" [pid 5222] <... write resumed>) = 1 [pid 5221] socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0 [pid 5218] <... socket resumed>) = 4 [pid 5223] <... ioctl resumed>, ifr_ifindex=11}) = 0 [pid 5222] close(3 [pid 5218] ioctl(4, SIOCGIFINDEX, {ifr_name="syz_tun" [pid 5223] close(4 [pid 5222] <... close resumed>) = 0 [pid 5218] <... ioctl resumed>, ifr_ifindex=11}) = 0 [pid 5223] <... close resumed>) = 0 [pid 5222] socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE [pid 5218] close(4 [pid 5223] sendto(3, [{nlmsg_len=48, nlmsg_type=0x1c /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x600, nlmsg_seq=0, nlmsg_pid=0}, "\x02\x00\x00\x00\x0b\x00\x00\x00\x80\x00\x00\x00\x08\x00\x01\x00\xac\x14\x14\xbb\x0a\x00\x02\x00\xbb\xaa\xaa\xaa\xaa\xaa\x00\x00"], 48, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 [pid 5222] <... socket resumed>) = 3 [pid 5218] <... close resumed>) = 0 [pid 5223] <... sendto resumed>) = 48 [pid 5222] socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0 [pid 5221] <... socket resumed>) = 4 [pid 5220] close(4 [pid 5218] sendto(3, [{nlmsg_len=64, nlmsg_type=0x14 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x500, nlmsg_seq=0, nlmsg_pid=0}, "\x0a\x78\x00\x00\x0b\x00\x00\x00\x14\x00\x02\x00\xfe\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xaa\x14\x00\x01\x00\xfe\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xaa"], 64, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 [pid 5223] recvfrom(3, [pid 5222] <... socket resumed>) = 4 [pid 5221] ioctl(4, SIOCGIFINDEX, {ifr_name="syz_tun" [pid 5220] <... close resumed>) = 0 [pid 5218] <... sendto resumed>) = 64 [pid 5223] <... recvfrom resumed>[{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=1}, {error=0, msg={nlmsg_len=48, nlmsg_type=0x1c /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x600, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36 [pid 5222] ioctl(4, SIOCGIFINDEX, {ifr_name="syz_tun" [pid 5223] socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0 [pid 5222] <... ioctl resumed>, ifr_ifindex=11}) = 0 [pid 5221] <... ioctl resumed>, ifr_ifindex=11}) = 0 [pid 5220] sendto(3, [{nlmsg_len=64, nlmsg_type=0x14 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x500, nlmsg_seq=0, nlmsg_pid=0}, "\x0a\x78\x00\x00\x0b\x00\x00\x00\x14\x00\x02\x00\xfe\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xaa\x14\x00\x01\x00\xfe\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xaa"], 64, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 [pid 5218] recvfrom(3, [pid 5223] <... socket resumed>) = 4 [pid 5222] close(4 [pid 5221] close(4 [pid 5218] <... recvfrom resumed>[{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=1}, {error=0, msg={nlmsg_len=64, nlmsg_type=0x14 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x500, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36 [pid 5223] ioctl(4, SIOCGIFINDEX, {ifr_name="syz_tun" [pid 5222] <... close resumed>) = 0 [pid 5221] <... close resumed>) = 0 [pid 5220] <... sendto resumed>) = 64 [pid 5218] socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0 [pid 5223] <... ioctl resumed>, ifr_ifindex=11}) = 0 [pid 5222] sendto(3, [{nlmsg_len=40, nlmsg_type=0x14 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x500, nlmsg_seq=0, nlmsg_pid=0}, "\x02\x18\x00\x00\x0b\x00\x00\x00\x08\x00\x02\x00\xac\x14\x14\xaa\x08\x00\x01\x00\xac\x14\x14\xaa"], 40, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 [pid 5221] sendto(3, [{nlmsg_len=48, nlmsg_type=0x1c /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x600, nlmsg_seq=0, nlmsg_pid=0}, "\x02\x00\x00\x00\x0b\x00\x00\x00\x80\x00\x00\x00\x08\x00\x01\x00\xac\x14\x14\xbb\x0a\x00\x02\x00\xbb\xaa\xaa\xaa\xaa\xaa\x00\x00"], 48, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 [pid 5220] recvfrom(3, [pid 5218] <... socket resumed>) = 4 [pid 5223] close(4 [pid 5222] <... sendto resumed>) = 40 [pid 5218] ioctl(4, SIOCGIFINDEX, {ifr_name="syz_tun" [pid 5223] <... close resumed>) = 0 [pid 5222] recvfrom(3, [pid 5221] <... sendto resumed>) = 48 [pid 5220] <... recvfrom resumed>[{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=1}, {error=0, msg={nlmsg_len=64, nlmsg_type=0x14 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x500, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36 [pid 5218] <... ioctl resumed>, ifr_ifindex=11}) = 0 [pid 5223] sendto(3, [{nlmsg_len=60, nlmsg_type=0x1c /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x600, nlmsg_seq=0, nlmsg_pid=0}, "\x0a\x00\x00\x00\x0b\x00\x00\x00\x80\x00\x00\x00\x14\x00\x01\x00\xfe\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xbb\x0a\x00\x02\x00\xbb\xaa\xaa\xaa\xaa\xaa\x00\x00"], 60, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 [pid 5222] <... recvfrom resumed>[{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=1}, {error=0, msg={nlmsg_len=40, nlmsg_type=0x14 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x500, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36 [pid 5221] recvfrom(3, [pid 5220] socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0 [pid 5218] close(4 [pid 5223] <... sendto resumed>) = 60 [pid 5222] socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0 [pid 5221] <... recvfrom resumed>[{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=1}, {error=0, msg={nlmsg_len=48, nlmsg_type=0x1c /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x600, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36 [pid 5220] <... socket resumed>) = 4 [pid 5218] <... close resumed>) = 0 [pid 5223] recvfrom(3, [pid 5222] <... socket resumed>) = 4 [pid 5221] socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0 [pid 5220] ioctl(4, SIOCGIFINDEX, {ifr_name="syz_tun" [pid 5218] sendto(3, [{nlmsg_len=48, nlmsg_type=0x1c /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x600, nlmsg_seq=0, nlmsg_pid=0}, "\x02\x00\x00\x00\x0b\x00\x00\x00\x80\x00\x00\x00\x08\x00\x01\x00\xac\x14\x14\xbb\x0a\x00\x02\x00\xbb\xaa\xaa\xaa\xaa\xaa\x00\x00"], 48, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 [pid 5223] <... recvfrom resumed>[{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=1}, {error=0, msg={nlmsg_len=60, nlmsg_type=0x1c /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x600, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36 [pid 5222] ioctl(4, SIOCGIFINDEX, {ifr_name="syz_tun" [pid 5221] <... socket resumed>) = 4 [pid 5220] <... ioctl resumed>, ifr_ifindex=11}) = 0 [pid 5218] <... sendto resumed>) = 48 [pid 5223] socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0 [pid 5222] <... ioctl resumed>, ifr_ifindex=11}) = 0 [pid 5218] recvfrom(3, [pid 5223] <... socket resumed>) = 4 [pid 5222] close(4 [pid 5221] ioctl(4, SIOCGIFINDEX, {ifr_name="syz_tun" [pid 5220] close(4 [pid 5218] <... recvfrom resumed>[{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=1}, {error=0, msg={nlmsg_len=48, nlmsg_type=0x1c /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x600, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36 [pid 5223] ioctl(4, SIOCGIFINDEX, {ifr_name="syz_tun" [pid 5222] <... close resumed>) = 0 [pid 5221] <... ioctl resumed>, ifr_ifindex=11}) = 0 [pid 5220] <... close resumed>) = 0 [pid 5223] <... ioctl resumed>, ifr_ifindex=11}) = 0 [pid 5221] close(4 [pid 5218] socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0 [pid 5223] close(4 [pid 5222] sendto(3, [{nlmsg_len=64, nlmsg_type=0x14 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x500, nlmsg_seq=0, nlmsg_pid=0}, "\x0a\x78\x00\x00\x0b\x00\x00\x00\x14\x00\x02\x00\xfe\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xaa\x14\x00\x01\x00\xfe\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xaa"], 64, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 [pid 5223] <... close resumed>) = 0 [pid 5221] <... close resumed>) = 0 [pid 5220] sendto(3, [{nlmsg_len=48, nlmsg_type=0x1c /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x600, nlmsg_seq=0, nlmsg_pid=0}, "\x02\x00\x00\x00\x0b\x00\x00\x00\x80\x00\x00\x00\x08\x00\x01\x00\xac\x14\x14\xbb\x0a\x00\x02\x00\xbb\xaa\xaa\xaa\xaa\xaa\x00\x00"], 48, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 [pid 5223] sendto(3, [{nlmsg_len=44, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x0b\x00\x00\x00\x01\x00\x00\x00\x01\x00\x00\x00\x0a\x00\x01\x00\xaa\xaa\xaa\xaa\xaa\xaa\x00\x00"], 44, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 [pid 5221] sendto(3, [{nlmsg_len=60, nlmsg_type=0x1c /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x600, nlmsg_seq=0, nlmsg_pid=0}, "\x0a\x00\x00\x00\x0b\x00\x00\x00\x80\x00\x00\x00\x14\x00\x01\x00\xfe\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xbb\x0a\x00\x02\x00\xbb\xaa\xaa\xaa\xaa\xaa\x00\x00"], 60, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 [pid 5218] <... socket resumed>) = 4 [pid 5220] <... sendto resumed>) = 48 [pid 5218] ioctl(4, SIOCGIFINDEX, {ifr_name="syz_tun" [pid 5220] recvfrom(3, [pid 5218] <... ioctl resumed>, ifr_ifindex=11}) = 0 [pid 5220] <... recvfrom resumed>[{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=1}, {error=0, msg={nlmsg_len=48, nlmsg_type=0x1c /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x600, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36 [pid 5218] close(4) = 0 [pid 5218] sendto(3, [{nlmsg_len=60, nlmsg_type=0x1c /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x600, nlmsg_seq=0, nlmsg_pid=0}, "\x0a\x00\x00\x00\x0b\x00\x00\x00\x80\x00\x00\x00\x14\x00\x01\x00\xfe\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xbb\x0a\x00\x02\x00\xbb\xaa\xaa\xaa\xaa\xaa\x00\x00"], 60, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 [pid 5220] socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0 [pid 5222] <... sendto resumed>) = 64 [pid 5220] <... socket resumed>) = 4 [pid 5222] recvfrom(3, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=1}, {error=0, msg={nlmsg_len=64, nlmsg_type=0x14 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x500, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36 [pid 5223] <... sendto resumed>) = 44 [pid 5222] socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0 [pid 5221] <... sendto resumed>) = 60 [pid 5220] ioctl(4, SIOCGIFINDEX, {ifr_name="syz_tun" [pid 5218] <... sendto resumed>) = 60 [pid 5223] recvfrom(3, [pid 5222] <... socket resumed>) = 4 [pid 5223] <... recvfrom resumed>[{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=1}, {error=0, msg={nlmsg_len=44, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36 [pid 5222] ioctl(4, SIOCGIFINDEX, {ifr_name="syz_tun" [pid 5223] close(3 [pid 5222] <... ioctl resumed>, ifr_ifindex=11}) = 0 [pid 5221] recvfrom(3, [pid 5220] <... ioctl resumed>, ifr_ifindex=11}) = 0 [pid 5218] recvfrom(3, [pid 5223] <... close resumed>) = 0 [pid 5222] close(4 [pid 5221] <... recvfrom resumed>[{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=1}, {error=0, msg={nlmsg_len=60, nlmsg_type=0x1c /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x600, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36 [pid 5220] close(4 [pid 5223] openat(AT_FDCWD, "/proc/sys/fs/mount-max", O_WRONLY|O_CLOEXEC [pid 5222] <... close resumed>) = 0 [pid 5221] socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0 [pid 5218] <... recvfrom resumed>[{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=1}, {error=0, msg={nlmsg_len=60, nlmsg_type=0x1c /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x600, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36 [pid 5223] <... openat resumed>) = 3 [pid 5222] sendto(3, [{nlmsg_len=48, nlmsg_type=0x1c /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x600, nlmsg_seq=0, nlmsg_pid=0}, "\x02\x00\x00\x00\x0b\x00\x00\x00\x80\x00\x00\x00\x08\x00\x01\x00\xac\x14\x14\xbb\x0a\x00\x02\x00\xbb\xaa\xaa\xaa\xaa\xaa\x00\x00"], 48, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 [pid 5221] <... socket resumed>) = 4 [pid 5220] <... close resumed>) = 0 [pid 5218] socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0 [pid 5223] write(3, "100000", 6 [pid 5222] <... sendto resumed>) = 48 [pid 5223] <... write resumed>) = 6 [pid 5222] recvfrom(3, [pid 5223] close(3 [pid 5222] <... recvfrom resumed>[{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=1}, {error=0, msg={nlmsg_len=48, nlmsg_type=0x1c /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x600, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36 [pid 5220] sendto(3, [{nlmsg_len=60, nlmsg_type=0x1c /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x600, nlmsg_seq=0, nlmsg_pid=0}, "\x0a\x00\x00\x00\x0b\x00\x00\x00\x80\x00\x00\x00\x14\x00\x01\x00\xfe\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xbb\x0a\x00\x02\x00\xbb\xaa\xaa\xaa\xaa\xaa\x00\x00"], 60, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 [pid 5218] <... socket resumed>) = 4 [pid 5223] <... close resumed>) = 0 [pid 5222] socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0 [pid 5221] ioctl(4, SIOCGIFINDEX, {ifr_name="syz_tun" [pid 5223] mkdir("./syz-tmp", 0777 [pid 5222] <... socket resumed>) = 4 [pid 5220] <... sendto resumed>) = 60 [pid 5218] ioctl(4, SIOCGIFINDEX, {ifr_name="syz_tun" [pid 5223] <... mkdir resumed>) = 0 [pid 5222] ioctl(4, SIOCGIFINDEX, {ifr_name="syz_tun" [pid 5221] <... ioctl resumed>, ifr_ifindex=11}) = 0 [pid 5220] recvfrom(3, [pid 5223] mount("", "./syz-tmp", "tmpfs", 0, NULL [pid 5222] <... ioctl resumed>, ifr_ifindex=11}) = 0 [pid 5218] <... ioctl resumed>, ifr_ifindex=11}) = 0 [pid 5223] <... mount resumed>) = 0 [pid 5222] close(4 [pid 5221] close(4 [pid 5220] <... recvfrom resumed>[{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=1}, {error=0, msg={nlmsg_len=60, nlmsg_type=0x1c /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x600, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36 [pid 5221] <... close resumed>) = 0 [pid 5218] close(4 [pid 5222] <... close resumed>) = 0 [pid 5218] <... close resumed>) = 0 [pid 5220] socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0 [pid 5222] sendto(3, [{nlmsg_len=60, nlmsg_type=0x1c /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x600, nlmsg_seq=0, nlmsg_pid=0}, "\x0a\x00\x00\x00\x0b\x00\x00\x00\x80\x00\x00\x00\x14\x00\x01\x00\xfe\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xbb\x0a\x00\x02\x00\xbb\xaa\xaa\xaa\xaa\xaa\x00\x00"], 60, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 [pid 5223] mkdir("./syz-tmp/newroot", 0777 [pid 5222] <... sendto resumed>) = 60 [pid 5221] sendto(3, [{nlmsg_len=44, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x0b\x00\x00\x00\x01\x00\x00\x00\x01\x00\x00\x00\x0a\x00\x01\x00\xaa\xaa\xaa\xaa\xaa\xaa\x00\x00"], 44, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 [pid 5220] <... socket resumed>) = 4 [pid 5218] sendto(3, [{nlmsg_len=44, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x0b\x00\x00\x00\x01\x00\x00\x00\x01\x00\x00\x00\x0a\x00\x01\x00\xaa\xaa\xaa\xaa\xaa\xaa\x00\x00"], 44, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 [pid 5223] <... mkdir resumed>) = 0 [pid 5222] recvfrom(3, [pid 5223] mkdir("./syz-tmp/newroot/dev", 0700 [pid 5222] <... recvfrom resumed>[{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=1}, {error=0, msg={nlmsg_len=60, nlmsg_type=0x1c /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x600, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36 [pid 5223] <... mkdir resumed>) = 0 [pid 5222] socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0 [pid 5220] ioctl(4, SIOCGIFINDEX, {ifr_name="syz_tun" [pid 5222] <... socket resumed>) = 4 [pid 5223] mount("/dev", "./syz-tmp/newroot/dev", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL [pid 5222] ioctl(4, SIOCGIFINDEX, {ifr_name="syz_tun" [pid 5220] <... ioctl resumed>, ifr_ifindex=11}) = 0 [pid 5223] <... mount resumed>) = 0 [pid 5222] <... ioctl resumed>, ifr_ifindex=11}) = 0 [pid 5222] close(4) = 0 [pid 5222] sendto(3, [{nlmsg_len=44, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x0b\x00\x00\x00\x01\x00\x00\x00\x01\x00\x00\x00\x0a\x00\x01\x00\xaa\xaa\xaa\xaa\xaa\xaa\x00\x00"], 44, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 [pid 5220] close(4 [pid 5221] <... sendto resumed>) = 44 [pid 5223] mkdir("./syz-tmp/newroot/proc", 0700 [pid 5221] recvfrom(3, [pid 5220] <... close resumed>) = 0 [pid 5223] <... mkdir resumed>) = 0 [pid 5221] <... recvfrom resumed>[{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=1}, {error=0, msg={nlmsg_len=44, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36 [pid 5220] sendto(3, [{nlmsg_len=44, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x0b\x00\x00\x00\x01\x00\x00\x00\x01\x00\x00\x00\x0a\x00\x01\x00\xaa\xaa\xaa\xaa\xaa\xaa\x00\x00"], 44, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 [pid 5223] mount("syz-proc", "./syz-tmp/newroot/proc", "proc", 0, NULL [pid 5221] close(3 [pid 5218] <... sendto resumed>) = 44 [pid 5223] <... mount resumed>) = 0 [pid 5221] <... close resumed>) = 0 [pid 5223] mkdir("./syz-tmp/newroot/selinux", 0700 [pid 5221] openat(AT_FDCWD, "/proc/sys/fs/mount-max", O_WRONLY|O_CLOEXEC [pid 5218] recvfrom(3, [pid 5222] <... sendto resumed>) = 44 [pid 5221] <... openat resumed>) = 3 [pid 5222] recvfrom(3, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=1}, {error=0, msg={nlmsg_len=44, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36 [pid 5222] close(3) = 0 [pid 5222] openat(AT_FDCWD, "/proc/sys/fs/mount-max", O_WRONLY|O_CLOEXEC [pid 5223] <... mkdir resumed>) = 0 [pid 5221] write(3, "100000", 6 [pid 5220] <... sendto resumed>) = 44 [pid 5218] <... recvfrom resumed>[{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=1}, {error=0, msg={nlmsg_len=44, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36 [pid 5221] <... write resumed>) = 6 [pid 5218] close(3 [pid 5221] close(3 [pid 5223] mount("/selinux", "./syz-tmp/newroot/selinux", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL [pid 5222] <... openat resumed>) = 3 [pid 5221] <... close resumed>) = 0 [pid 5220] recvfrom(3, [pid 5218] <... close resumed>) = 0 [pid 5223] <... mount resumed>) = -1 ENOENT (No such file or directory) [pid 5222] write(3, "100000", 6 [pid 5221] mkdir("./syz-tmp", 0777 [pid 5220] <... recvfrom resumed>[{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=1}, {error=0, msg={nlmsg_len=44, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36 [pid 5218] openat(AT_FDCWD, "/proc/sys/fs/mount-max", O_WRONLY|O_CLOEXEC [pid 5223] mount("/sys/fs/selinux", "./syz-tmp/newroot/selinux", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL [pid 5222] <... write resumed>) = 6 [pid 5221] <... mkdir resumed>) = 0 [pid 5220] close(3 [pid 5223] <... mount resumed>) = 0 [pid 5222] close(3 [pid 5221] mount("", "./syz-tmp", "tmpfs", 0, NULL [pid 5220] <... close resumed>) = 0 [pid 5218] <... openat resumed>) = 3 [pid 5220] openat(AT_FDCWD, "/proc/sys/fs/mount-max", O_WRONLY|O_CLOEXEC) = 3 [pid 5220] write(3, "100000", 6 [pid 5221] <... mount resumed>) = 0 [pid 5220] <... write resumed>) = 6 [pid 5222] <... close resumed>) = 0 [pid 5220] close(3 [pid 5218] write(3, "100000", 6 [pid 5222] mkdir("./syz-tmp", 0777 [pid 5220] <... close resumed>) = 0 [pid 5222] <... mkdir resumed>) = 0 [pid 5221] mkdir("./syz-tmp/newroot", 0777 [pid 5220] mkdir("./syz-tmp", 0777 [pid 5218] <... write resumed>) = 6 [pid 5223] mkdir("./syz-tmp/newroot/sys", 0700 [pid 5221] <... mkdir resumed>) = 0 [pid 5220] <... mkdir resumed>) = 0 [pid 5223] <... mkdir resumed>) = 0 [pid 5222] mount("", "./syz-tmp", "tmpfs", 0, NULL [pid 5218] close(3 [pid 5221] mkdir("./syz-tmp/newroot/dev", 0700 [pid 5218] <... close resumed>) = 0 [pid 5222] <... mount resumed>) = 0 [pid 5218] mkdir("./syz-tmp", 0777 [pid 5223] mount("/sys", "./syz-tmp/newroot/sys", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL) = 0 [pid 5221] <... mkdir resumed>) = 0 [pid 5218] <... mkdir resumed>) = 0 [pid 5220] mount("", "./syz-tmp", "tmpfs", 0, NULL) = 0 [pid 5222] mkdir("./syz-tmp/newroot", 0777) = 0 [pid 5222] mkdir("./syz-tmp/newroot/dev", 0700) = 0 [pid 5221] mount("/dev", "./syz-tmp/newroot/dev", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL [pid 5218] mount("", "./syz-tmp", "tmpfs", 0, NULL [pid 5223] mkdir("./syz-tmp/pivot", 0777) = 0 [pid 5222] mount("/dev", "./syz-tmp/newroot/dev", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL [pid 5220] mkdir("./syz-tmp/newroot", 0777 [pid 5218] <... mount resumed>) = 0 [pid 5223] pivot_root("./syz-tmp", "./syz-tmp/pivot" [pid 5222] <... mount resumed>) = 0 [pid 5221] <... mount resumed>) = 0 [pid 5220] <... mkdir resumed>) = 0 [pid 5218] mkdir("./syz-tmp/newroot", 0777 [pid 5223] <... pivot_root resumed>) = 0 [pid 5220] mkdir("./syz-tmp/newroot/dev", 0700) = 0 [pid 5223] chdir("/" [pid 5222] mkdir("./syz-tmp/newroot/proc", 0700 [pid 5221] mkdir("./syz-tmp/newroot/proc", 0700 [pid 5220] mount("/dev", "./syz-tmp/newroot/dev", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL [pid 5218] <... mkdir resumed>) = 0 [pid 5223] <... chdir resumed>) = 0 [pid 5222] <... mkdir resumed>) = 0 [pid 5221] <... mkdir resumed>) = 0 [pid 5220] <... mount resumed>) = 0 [pid 5223] umount2("./pivot", MNT_DETACH [pid 5222] mount("syz-proc", "./syz-tmp/newroot/proc", "proc", 0, NULL [pid 5218] mkdir("./syz-tmp/newroot/dev", 0700 [pid 5222] <... mount resumed>) = 0 [pid 5223] <... umount2 resumed>) = 0 [pid 5221] mount("syz-proc", "./syz-tmp/newroot/proc", "proc", 0, NULL [pid 5218] <... mkdir resumed>) = 0 [pid 5221] <... mount resumed>) = 0 [pid 5220] mkdir("./syz-tmp/newroot/proc", 0700 [pid 5218] mount("/dev", "./syz-tmp/newroot/dev", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL [pid 5223] chroot("./newroot" [pid 5222] mkdir("./syz-tmp/newroot/selinux", 0700 [pid 5218] <... mount resumed>) = 0 [pid 5220] <... mkdir resumed>) = 0 [pid 5222] <... mkdir resumed>) = 0 [pid 5223] <... chroot resumed>) = 0 [pid 5220] mount("syz-proc", "./syz-tmp/newroot/proc", "proc", 0, NULL [pid 5222] mount("/selinux", "./syz-tmp/newroot/selinux", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL) = -1 ENOENT (No such file or directory) [pid 5223] chdir("/" [pid 5220] <... mount resumed>) = 0 [pid 5223] <... chdir resumed>) = 0 [pid 5218] mkdir("./syz-tmp/newroot/proc", 0700 [pid 5222] mount("/sys/fs/selinux", "./syz-tmp/newroot/selinux", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL [pid 5218] <... mkdir resumed>) = 0 [pid 5223] mkdir("/dev/binderfs", 0777 [pid 5222] <... mount resumed>) = 0 [pid 5223] <... mkdir resumed>) = 0 [pid 5221] mkdir("./syz-tmp/newroot/selinux", 0700 [pid 5218] mount("syz-proc", "./syz-tmp/newroot/proc", "proc", 0, NULL [pid 5222] mkdir("./syz-tmp/newroot/sys", 0700 [pid 5220] mkdir("./syz-tmp/newroot/selinux", 0700 [pid 5221] <... mkdir resumed>) = 0 [pid 5218] <... mount resumed>) = 0 [pid 5222] <... mkdir resumed>) = 0 [pid 5223] mount("binder", "/dev/binderfs", "binder", 0, NULL [pid 5222] mount("/sys", "./syz-tmp/newroot/sys", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL [pid 5221] mount("/selinux", "./syz-tmp/newroot/selinux", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL [pid 5220] <... mkdir resumed>) = 0 [pid 5218] mkdir("./syz-tmp/newroot/selinux", 0700 [pid 5223] <... mount resumed>) = 0 [pid 5222] <... mount resumed>) = 0 [pid 5221] <... mount resumed>) = -1 ENOENT (No such file or directory) [pid 5223] mkdir("./0", 0777 [pid 5222] mkdir("./syz-tmp/pivot", 0777 [pid 5221] mount("/sys/fs/selinux", "./syz-tmp/newroot/selinux", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL [pid 5220] mount("/selinux", "./syz-tmp/newroot/selinux", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL [pid 5218] <... mkdir resumed>) = 0 [pid 5223] <... mkdir resumed>) = 0 [pid 5222] <... mkdir resumed>) = 0 [pid 5221] <... mount resumed>) = 0 [pid 5218] mount("/selinux", "./syz-tmp/newroot/selinux", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL [pid 5222] pivot_root("./syz-tmp", "./syz-tmp/pivot" [pid 5221] mkdir("./syz-tmp/newroot/sys", 0700 [pid 5220] <... mount resumed>) = -1 ENOENT (No such file or directory) [pid 5218] <... mount resumed>) = -1 ENOENT (No such file or directory) [pid 5223] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5222] <... pivot_root resumed>) = 0 [pid 5221] <... mkdir resumed>) = 0 [pid 5218] mount("/sys/fs/selinux", "./syz-tmp/newroot/selinux", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL [pid 5222] chdir("/" [pid 5220] mount("/sys/fs/selinux", "./syz-tmp/newroot/selinux", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL [pid 5222] <... chdir resumed>) = 0 [pid 5221] mount("/sys", "./syz-tmp/newroot/sys", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL [pid 5218] <... mount resumed>) = 0 [pid 5222] umount2("./pivot", MNT_DETACH [pid 5221] <... mount resumed>) = 0 [pid 5220] <... mount resumed>) = 0 [pid 5218] mkdir("./syz-tmp/newroot/sys", 0700 [pid 5222] <... umount2 resumed>) = 0 [pid 5220] mkdir("./syz-tmp/newroot/sys", 0700 [pid 5218] <... mkdir resumed>) = 0 [pid 5222] chroot("./newroot" [pid 5221] mkdir("./syz-tmp/pivot", 0777 [pid 5222] <... chroot resumed>) = 0 [pid 5221] <... mkdir resumed>) = 0 [pid 5220] <... mkdir resumed>) = 0 [pid 5222] chdir("/" [pid 5220] mount("/sys", "./syz-tmp/newroot/sys", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL [pid 5218] mount("/sys", "./syz-tmp/newroot/sys", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL [pid 5223] <... clone resumed>, child_tidptr=0x55557acf5690) = 3 [pid 5222] <... chdir resumed>) = 0 [pid 5221] pivot_root("./syz-tmp", "./syz-tmp/pivot" [pid 5218] <... mount resumed>) = 0 ./strace-static-x86_64: Process 5246 attached [pid 5222] mkdir("/dev/binderfs", 0777 [pid 5221] <... pivot_root resumed>) = 0 [pid 5220] <... mount resumed>) = 0 [pid 5246] set_robust_list(0x55557acf56a0, 24 [pid 5222] <... mkdir resumed>) = -1 EEXIST (File exists) [pid 5222] mount("binder", "/dev/binderfs", "binder", 0, NULL [pid 5246] <... set_robust_list resumed>) = 0 [pid 5222] <... mount resumed>) = 0 [pid 5220] mkdir("./syz-tmp/pivot", 0777 [pid 5218] mkdir("./syz-tmp/pivot", 0777 [pid 5221] chdir("/" [pid 5246] chdir("./0" [pid 5221] <... chdir resumed>) = 0 [pid 5221] umount2("./pivot", MNT_DETACH [pid 5246] <... chdir resumed>) = 0 [pid 5220] <... mkdir resumed>) = 0 [pid 5218] <... mkdir resumed>) = 0 [pid 5221] <... umount2 resumed>) = 0 [pid 5218] pivot_root("./syz-tmp", "./syz-tmp/pivot" [pid 5246] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5220] pivot_root("./syz-tmp", "./syz-tmp/pivot" [pid 5246] <... prctl resumed>) = 0 [pid 5221] chroot("./newroot" [pid 5218] <... pivot_root resumed>) = 0 [pid 5222] mkdir("./0", 0777 [pid 5221] <... chroot resumed>) = 0 [pid 5246] setpgid(0, 0 [pid 5220] <... pivot_root resumed>) = 0 [pid 5222] <... mkdir resumed>) = 0 [pid 5246] <... setpgid resumed>) = 0 [pid 5222] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5221] chdir("/" [pid 5220] chdir("/" [pid 5218] chdir("/"./strace-static-x86_64: Process 5247 attached [pid 5246] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5221] <... chdir resumed>) = 0 [pid 5246] <... openat resumed>) = 3 [pid 5221] mkdir("/dev/binderfs", 0777 [pid 5220] <... chdir resumed>) = 0 [pid 5218] <... chdir resumed>) = 0 [pid 5221] <... mkdir resumed>) = -1 EEXIST (File exists) [pid 5220] umount2("./pivot", MNT_DETACH [pid 5218] umount2("./pivot", MNT_DETACH [pid 5247] set_robust_list(0x55557acf56a0, 24 [pid 5221] mount("binder", "/dev/binderfs", "binder", 0, NULL [pid 5220] <... umount2 resumed>) = 0 [pid 5247] <... set_robust_list resumed>) = 0 [pid 5246] write(3, "1000", 4 [pid 5221] <... mount resumed>) = 0 [pid 5218] <... umount2 resumed>) = 0 [pid 5246] <... write resumed>) = 4 [pid 5222] <... clone resumed>, child_tidptr=0x55557acf5690) = 3 [pid 5220] chroot("./newroot" [pid 5247] chdir("./0" [pid 5246] close(3 [pid 5218] chroot("./newroot" [pid 5246] <... close resumed>) = 0 [pid 5220] <... chroot resumed>) = 0 [pid 5247] <... chdir resumed>) = 0 [pid 5246] read(200, [pid 5221] mkdir("./0", 0777 [pid 5220] chdir("/" [pid 5218] <... chroot resumed>) = 0 [pid 5247] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5246] <... read resumed>"\x33\x33\x00\x00\x00\x16\xaa\xaa\xaa\xaa\xaa\xaa\x86\xdd\x60\x00\x00\x00\x00\x38\x00\x01\xfe\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xaa\xff\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x16\x3a\x00\x05\x02\x00\x00\x01\x00\x8f\x00\xc2\x46\x00\x00\x00\x02\x04\x00\x00\x00\xff\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\xff\xaa\xaa\xaa\x04\x00\x00\x00\xff\x02\x00\x00\x00\x00"..., 1000) = 110 [pid 5218] chdir("/" [pid 5247] <... prctl resumed>) = 0 [pid 5246] read(200, [pid 5221] <... mkdir resumed>) = 0 [pid 5220] <... chdir resumed>) = 0 [pid 5247] setpgid(0, 0 [pid 5246] <... read resumed>"\x33\x33\x00\x00\x00\x16\xaa\xaa\xaa\xaa\xaa\xaa\x86\xdd\x60\x00\x00\x00\x00\x38\x00\x01\xfe\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xaa\xff\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x16\x3a\x00\x05\x02\x00\x00\x01\x00\x8f\x00\xc2\x46\x00\x00\x00\x02\x04\x00\x00\x00\xff\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\xff\xaa\xaa\xaa\x04\x00\x00\x00\xff\x02\x00\x00\x00\x00"..., 1000) = 110 [pid 5220] mkdir("/dev/binderfs", 0777 [pid 5218] <... chdir resumed>) = 0 [pid 5247] <... setpgid resumed>) = 0 [pid 5246] read(200, [pid 5221] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5220] <... mkdir resumed>) = -1 EEXIST (File exists) [pid 5218] mkdir("/dev/binderfs", 0777 [pid 5247] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5246] <... read resumed>0x7fff61787440, 1000) = -1 EAGAIN (Resource temporarily unavailable) [pid 5218] <... mkdir resumed>) = -1 EEXIST (File exists) ./strace-static-x86_64: Process 5248 attached [pid 5246] symlink("/dev/binderfs", "./binderfs" [pid 5220] mount("binder", "/dev/binderfs", "binder", 0, NULL [pid 5247] <... openat resumed>) = 3 [pid 5248] set_robust_list(0x55557acf56a0, 24 [pid 5247] write(3, "1000", 4 [pid 5248] <... set_robust_list resumed>) = 0 [pid 5247] <... write resumed>) = 4 [pid 5248] chdir("./0" [pid 5247] close(3 [pid 5248] <... chdir resumed>) = 0 [pid 5247] <... close resumed>) = 0 [pid 5246] <... symlink resumed>) = 0 [pid 5220] <... mount resumed>) = 0 [pid 5218] mount("binder", "/dev/binderfs", "binder", 0, NULL [pid 5248] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5247] read(200, [pid 5248] <... prctl resumed>) = 0 [pid 5247] <... read resumed>"\x33\x33\x00\x00\x00\x16\xaa\xaa\xaa\xaa\xaa\xaa\x86\xdd\x60\x00\x00\x00\x00\x38\x00\x01\xfe\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xaa\xff\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x16\x3a\x00\x05\x02\x00\x00\x01\x00\x8f\x00\xc2\x46\x00\x00\x00\x02\x04\x00\x00\x00\xff\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\xff\xaa\xaa\xaa\x04\x00\x00\x00\xff\x02\x00\x00\x00\x00"..., 1000) = 110 [pid 5248] setpgid(0, 0 [pid 5247] read(200, [pid 5246] write(1, "executing program\n", 18 [pid 5218] <... mount resumed>) = 0 [pid 5248] <... setpgid resumed>) = 0 [pid 5247] <... read resumed>0x7fff61787440, 1000) = -1 EAGAIN (Resource temporarily unavailable) executing program [pid 5248] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5247] symlink("/dev/binderfs", "./binderfs" [pid 5246] <... write resumed>) = 18 [pid 5221] <... clone resumed>, child_tidptr=0x55557acf5690) = 3 [pid 5220] mkdir("./0", 0777 [pid 5248] <... openat resumed>) = 3 [pid 5246] openat(AT_FDCWD, "/proc/self/ns/net", O_RDONLY [pid 5220] <... mkdir resumed>) = 0 [pid 5218] mkdir("./0", 0777 [pid 5248] write(3, "1000", 4 [pid 5247] <... symlink resumed>) = 0 [pid 5246] <... openat resumed>) = 3 [pid 5248] <... write resumed>) = 4 [pid 5247] write(1, "executing program\n", 18 [pid 5246] setns(201, 0executing program [pid 5220] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5218] <... mkdir resumed>) = 0 [pid 5248] close(3 [pid 5247] <... write resumed>) = 18 [pid 5246] <... setns resumed>) = 0 [pid 5248] <... close resumed>) = 0 [pid 5247] openat(AT_FDCWD, "/proc/self/ns/net", O_RDONLY [pid 5248] read(200, [pid 5247] <... openat resumed>) = 3 [pid 5218] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5248] <... read resumed>"\x33\x33\x00\x00\x00\x16\xaa\xaa\xaa\xaa\xaa\xaa\x86\xdd\x60\x00\x00\x00\x00\x38\x00\x01\xfe\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xaa\xff\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x16\x3a\x00\x05\x02\x00\x00\x01\x00\x8f\x00\xc2\x46\x00\x00\x00\x02\x04\x00\x00\x00\xff\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\xff\xaa\xaa\xaa\x04\x00\x00\x00\xff\x02\x00\x00\x00\x00"..., 1000) = 110 [pid 5246] socket(AF_BLUETOOTH, SOCK_SEQPACKET, BTPROTO_SCO./strace-static-x86_64: Process 5249 attached [pid 5248] read(200, [pid 5247] setns(201, 0 [pid 5246] <... socket resumed>) = 4 [pid 5220] <... clone resumed>, child_tidptr=0x55557acf5690) = 3 [pid 5249] set_robust_list(0x55557acf56a0, 24 [pid 5248] <... read resumed>"\x33\x33\x00\x00\x00\x16\xaa\xaa\xaa\xaa\xaa\xaa\x86\xdd\x60\x00\x00\x00\x00\x38\x00\x01\xfe\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xaa\xff\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x16\x3a\x00\x05\x02\x00\x00\x01\x00\x8f\x00\xc2\x46\x00\x00\x00\x02\x04\x00\x00\x00\xff\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\xff\xaa\xaa\xaa\x04\x00\x00\x00\xff\x02\x00\x00\x00\x00"..., 1000) = 110 [pid 5247] <... setns resumed>) = 0 [pid 5246] setns(3, 0./strace-static-x86_64: Process 5250 attached [pid 5249] <... set_robust_list resumed>) = 0 [pid 5248] read(200, [pid 5247] socket(AF_BLUETOOTH, SOCK_SEQPACKET, BTPROTO_SCO [pid 5250] set_robust_list(0x55557acf56a0, 24 [pid 5249] chdir("./0" [pid 5248] <... read resumed>0x7fff61787440, 1000) = -1 EAGAIN (Resource temporarily unavailable) [pid 5247] <... socket resumed>) = 4 [pid 5246] <... setns resumed>) = 0 [pid 5218] <... clone resumed>, child_tidptr=0x55557acf5690) = 3 [pid 5250] <... set_robust_list resumed>) = 0 [pid 5249] <... chdir resumed>) = 0 [pid 5248] symlink("/dev/binderfs", "./binderfs" [pid 5247] setns(3, 0 [pid 5246] close(3 [pid 5250] chdir("./0" [pid 5249] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5246] <... close resumed>) = 0 [pid 5250] <... chdir resumed>) = 0 [pid 5249] <... prctl resumed>) = 0 [pid 5248] <... symlink resumed>) = 0 [pid 5247] <... setns resumed>) = 0 [pid 5246] bind(4, {sa_family=AF_BLUETOOTH, sco_bdaddr=00:00:00:00:00:00}, 8 [pid 5250] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5249] setpgid(0, 0 [pid 5248] write(1, "executing program\n", 18 [pid 5247] close(3 [pid 5250] <... prctl resumed>) = 0 [pid 5249] <... setpgid resumed>) = 0 [pid 5247] <... close resumed>) = 0 [pid 5246] <... bind resumed>) = 0 [pid 5249] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5247] bind(4, {sa_family=AF_BLUETOOTH, sco_bdaddr=00:00:00:00:00:00}, 8 [pid 5246] listen(4, 0executing program [pid 5250] setpgid(0, 0 [pid 5249] <... openat resumed>) = 3 [pid 5248] <... write resumed>) = 18 [pid 5247] <... bind resumed>) = 0 [pid 5246] <... listen resumed>) = 0 [pid 5250] <... setpgid resumed>) = 0 [pid 5248] openat(AT_FDCWD, "/proc/self/ns/net", O_RDONLY [pid 5247] listen(4, 0) = -1 EADDRINUSE (Address already in use) [pid 5249] write(3, "1000", 4 [pid 5247] write(202, "\x04\x04\x0a\x00\x00\x00\x00\x00\x00\x54\x67\x92\x00", 13 [pid 5248] <... openat resumed>) = 3 [pid 5250] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5249] <... write resumed>) = 4 [pid 5246] write(202, "\x04\x04\x0a\x00\x00\x00\x00\x00\x00\x54\x67\x92\x00", 13 [pid 5250] <... openat resumed>) = 3 [pid 5248] setns(201, 0 [pid 5247] <... write resumed>) = 13 [pid 5250] write(3, "1000", 4 [pid 5249] close(3 [pid 5248] <... setns resumed>) = 0 [pid 5247] write(202, "\x04\x2c\x11\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00", 20 [pid 5246] <... write resumed>) = 13 [pid 5250] <... write resumed>) = 4 [pid 5249] <... close resumed>) = 0 [pid 5248] socket(AF_BLUETOOTH, SOCK_SEQPACKET, BTPROTO_SCO [pid 5247] <... write resumed>) = 20 [pid 5246] write(202, "\x04\x2c\x11\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00", 20 [pid 5247] close(3) = -1 EBADF (Bad file descriptor) [pid 5247] close(4) = 0 [pid 5247] close(5) = -1 EBADF (Bad file descriptor) [pid 5247] close(6) = -1 EBADF (Bad file descriptor) [pid 5247] close(7) = -1 EBADF (Bad file descriptor) [pid 5247] close(8) = -1 EBADF (Bad file descriptor) [pid 5247] close(9) = -1 EBADF (Bad file descriptor) [pid 5247] close(10) = -1 EBADF (Bad file descriptor) [pid 5247] close(11) = -1 EBADF (Bad file descriptor) [pid 5247] close(12) = -1 EBADF (Bad file descriptor) [pid 5247] close(13) = -1 EBADF (Bad file descriptor) [pid 5247] close(14) = -1 EBADF (Bad file descriptor) [pid 5247] close(15) = -1 EBADF (Bad file descriptor) [pid 5247] close(16) = -1 EBADF (Bad file descriptor) [pid 5247] close(17) = -1 EBADF (Bad file descriptor) [pid 5247] close(18) = -1 EBADF (Bad file descriptor) [pid 5247] close(19) = -1 EBADF (Bad file descriptor) [pid 5247] close(20) = -1 EBADF (Bad file descriptor) [pid 5247] close(21) = -1 EBADF (Bad file descriptor) [pid 5247] close(22) = -1 EBADF (Bad file descriptor) [pid 5247] close(23) = -1 EBADF (Bad file descriptor) [pid 5247] close(24) = -1 EBADF (Bad file descriptor) [pid 5247] close(25) = -1 EBADF (Bad file descriptor) [pid 5247] close(26) = -1 EBADF (Bad file descriptor) [pid 5247] close(27) = -1 EBADF (Bad file descriptor) [pid 5247] close(28) = -1 EBADF (Bad file descriptor) [pid 5247] close(29) = -1 EBADF (Bad file descriptor) [pid 5247] exit_group(0 [pid 5250] close(3 [pid 5249] read(200, [pid 5248] <... socket resumed>) = 4 [pid 5246] <... write resumed>) = 20 [pid 5250] <... close resumed>) = 0 [pid 5249] <... read resumed>"\x33\x33\x00\x00\x00\x16\xaa\xaa\xaa\xaa\xaa\xaa\x86\xdd\x60\x00\x00\x00\x00\x38\x00\x01\xfe\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xaa\xff\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x16\x3a\x00\x05\x02\x00\x00\x01\x00\x8f\x00\xc2\x46\x00\x00\x00\x02\x04\x00\x00\x00\xff\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\xff\xaa\xaa\xaa\x04\x00\x00\x00\xff\x02\x00\x00\x00\x00"..., 1000) = 110 [pid 5248] setns(3, 0 [pid 5247] <... exit_group resumed>) = ? [pid 5246] close(3 [pid 5250] read(200, [pid 5249] read(200, [pid 5248] <... setns resumed>) = 0 [pid 5246] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5250] <... read resumed>"\x33\x33\x00\x00\x00\x16\xaa\xaa\xaa\xaa\xaa\xaa\x86\xdd\x60\x00\x00\x00\x00\x38\x00\x01\xfe\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xaa\xff\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x16\x3a\x00\x05\x02\x00\x00\x01\x00\x8f\x00\xc2\x46\x00\x00\x00\x02\x04\x00\x00\x00\xff\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\xff\xaa\xaa\xaa\x04\x00\x00\x00\xff\x02\x00\x00\x00\x00"..., 1000) = 110 [pid 5249] <... read resumed>0x7fff61787440, 1000) = -1 EAGAIN (Resource temporarily unavailable) [pid 5248] close(3 [pid 5246] close(4 [pid 5250] read(200, [pid 5249] symlink("/dev/binderfs", "./binderfs" [pid 5248] <... close resumed>) = 0 [pid 5246] <... close resumed>) = 0 [pid 5250] <... read resumed>0x7fff61787440, 1000) = -1 EAGAIN (Resource temporarily unavailable) [ 79.657879][ T5232] BUG: sleeping function called from invalid context at net/core/sock.c:3545 [ 79.666946][ T5232] in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 5232, name: kworker/u9:4 [ 79.676391][ T5232] preempt_count: 1, expected: 0 [ 79.681324][ T5232] RCU nest depth: 0, expected: 0 [ 79.686265][ T5232] 6 locks held by kworker/u9:4/5232: [ 79.691570][ T5232] #0: ffff888022682948 ((wq_completion)hci4#2){+.+.}-{0:0}, at: process_one_work+0x1277/0x1b40 [pid 5250] symlink("/dev/binderfs", "./binderfs"executing program executing program [pid 5249] <... symlink resumed>) = 0 [pid 5248] bind(4, {sa_family=AF_BLUETOOTH, sco_bdaddr=00:00:00:00:00:00}, 8 [pid 5246] close(5 [pid 5250] <... symlink resumed>) = 0 [pid 5249] write(1, "executing program\n", 18 [pid 5248] <... bind resumed>) = 0 [pid 5250] write(1, "executing program\n", 18 [pid 5249] <... write resumed>) = 18 [pid 5248] listen(4, 0 [pid 5246] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5250] <... write resumed>) = 18 [pid 5249] openat(AT_FDCWD, "/proc/self/ns/net", O_RDONLY [pid 5248] <... listen resumed>) = 0 [pid 5246] close(6 [pid 5250] openat(AT_FDCWD, "/proc/self/ns/net", O_RDONLY [pid 5249] <... openat resumed>) = 3 [pid 5248] write(202, "\x04\x04\x0a\x00\x00\x00\x00\x00\x00\x54\x67\x92\x00", 13 [pid 5246] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5250] <... openat resumed>) = 3 [pid 5249] setns(201, 0 [pid 5248] <... write resumed>) = 13 [pid 5249] <... setns resumed>) = 0 [pid 5248] write(202, "\x04\x2c\x11\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00", 20 [pid 5246] close(7 [pid 5249] socket(AF_BLUETOOTH, SOCK_SEQPACKET, BTPROTO_SCO [pid 5248] <... write resumed>) = 20 [pid 5246] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5250] setns(201, 0 [pid 5249] <... socket resumed>) = 4 [pid 5248] close(3 [pid 5250] <... setns resumed>) = 0 [pid 5249] setns(3, 0 [pid 5248] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5246] close(8 [pid 5250] socket(AF_BLUETOOTH, SOCK_SEQPACKET, BTPROTO_SCO [pid 5249] <... setns resumed>) = 0 [pid 5248] close(4 [pid 5246] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5250] <... socket resumed>) = 4 [pid 5249] close(3 [pid 5248] <... close resumed>) = 0 [pid 5250] setns(3, 0 [pid 5249] <... close resumed>) = 0 [pid 5248] close(5 [pid 5246] close(9 [pid 5250] <... setns resumed>) = 0 [pid 5249] bind(4, {sa_family=AF_BLUETOOTH, sco_bdaddr=00:00:00:00:00:00}, 8 [pid 5248] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5246] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5250] close(3 [pid 5249] <... bind resumed>) = 0 [pid 5248] close(6 [pid 5246] close(10 [pid 5250] <... close resumed>) = 0 [pid 5249] listen(4, 0 [pid 5248] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5246] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5250] bind(4, {sa_family=AF_BLUETOOTH, sco_bdaddr=00:00:00:00:00:00}, 8 [pid 5249] <... listen resumed>) = 0 [pid 5248] close(7 [pid 5246] close(11 [pid 5250] <... bind resumed>) = 0 [pid 5249] write(202, "\x04\x04\x0a\x00\x00\x00\x00\x00\x00\x54\x67\x92\x00", 13 [pid 5248] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5246] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5250] listen(4, 0 [pid 5249] <... write resumed>) = 13 [pid 5250] <... listen resumed>) = -1 EADDRINUSE (Address already in use) [pid 5249] write(202, "\x04\x2c\x11\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00", 20 [pid 5248] close(8 [pid 5246] close(12 [pid 5250] write(202, "\x04\x04\x0a\x00\x00\x00\x00\x00\x00\x54\x67\x92\x00", 13 [pid 5249] <... write resumed>) = 20 [ 79.702342][ T5232] #1: ffffc900032afd80 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_one_work+0x921/0x1b40 [ 79.713874][ T5232] #2: ffff88802cb98078 (&hdev->lock){+.+.}-{3:3}, at: hci_sync_conn_complete_evt+0x118/0xa10 [ 79.724281][ T5232] #3: ffffffff8fc880e8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_sync_conn_complete_evt+0x336/0xa10 [ 79.735121][ T5232] #4: ffff8880217dfa20 (&conn->lock#2){+.+.}-{2:2}, at: sco_connect_cfm+0x2d1/0xc10 [ 79.745087][ T5232] #5: ffff88807e735258 (sk_lock-AF_BLUETOOTH-BTPROTO_SCO){+.+.}-{0:0}, at: sco_connect_cfm+0x3ee/0xc10 [pid 5248] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5247] +++ exited with 0 +++ [pid 5246] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5250] <... write resumed>) = 13 [pid 5249] close(3 [pid 5248] close(9 [pid 5246] close(13 [pid 5250] write(202, "\x04\x2c\x11\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00", 20 [pid 5249] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5248] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5246] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5222] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=3, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5250] <... write resumed>) = 20 [pid 5250] close(3 [pid 5248] close(10 [pid 5246] close(14 [pid 5222] umount2("./0", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5248] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5246] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5222] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5246] close(15 [pid 5222] openat(AT_FDCWD, "./0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5250] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5249] close(4 [pid 5248] close(11 [pid 5246] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5222] <... openat resumed>) = 3 [pid 5250] close(4 [pid 5249] <... close resumed>) = 0 [pid 5248] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5246] close(16 [pid 5222] newfstatat(3, "", [pid 5250] <... close resumed>) = 0 [pid 5249] close(5 [pid 5248] close(12 [pid 5246] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5222] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=60, ...}, AT_EMPTY_PATH) = 0 [pid 5250] close(5 [pid 5249] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5248] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5246] close(17 [pid 5222] getdents64(3, [pid 5250] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5249] close(6 [pid 5248] close(13 [pid 5246] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5222] <... getdents64 resumed>0x55557acf6850 /* 3 entries */, 32768) = 80 [pid 5250] close(6 [pid 5249] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5248] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5246] close(18 [pid 5222] umount2("./0/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5250] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5249] close(7 [pid 5248] close(14 [pid 5246] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5250] close(7 [pid 5249] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5248] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5222] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5250] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5249] close(8 [pid 5248] close(15 [pid 5250] close(8 [pid 5249] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5222] newfstatat(AT_FDCWD, "./0/binderfs", [pid 5250] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5249] close(9 [pid 5248] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5246] close(19 [pid 5222] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5250] close(9 [pid 5249] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5248] close(16 [pid 5250] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5249] close(10 [pid 5248] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5246] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5222] unlink("./0/binderfs" [pid 5250] close(10 [pid 5249] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5248] close(17 [pid 5246] close(20 [pid 5222] <... unlink resumed>) = 0 [pid 5250] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5249] close(11 [pid 5248] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5246] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5222] getdents64(3, [pid 5250] close(11 [pid 5249] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5248] close(18 [pid 5246] close(21 [pid 5222] <... getdents64 resumed>0x55557acf6850 /* 0 entries */, 32768) = 0 [pid 5250] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5249] close(12 [pid 5248] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5246] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5222] close(3 [pid 5250] close(12 [pid 5249] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5248] close(19 [pid 5246] close(22 [pid 5222] <... close resumed>) = 0 [pid 5250] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5249] close(13 [pid 5248] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5246] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5222] rmdir("./0" [pid 5250] close(13 [pid 5249] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5248] close(20 [pid 5246] close(23 [pid 5222] <... rmdir resumed>) = 0 [pid 5250] <... close resumed>) = -1 EBADF (Bad file descriptor) [ 79.756373][ T5232] Preemption disabled at: [ 79.756388][ T5232] [<0000000000000000>] 0x0 [ 79.765207][ T5232] CPU: 0 UID: 0 PID: 5232 Comm: kworker/u9:4 Not tainted 6.11.0-rc5-syzkaller #0 [ 79.774335][ T5232] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024 [ 79.784417][ T5232] Workqueue: hci4 hci_rx_work [ 79.789143][ T5232] Call Trace: [ 79.792440][ T5232] [ 79.795385][ T5232] dump_stack_lvl+0x16c/0x1f0 [ 79.800085][ T5232] __might_resched+0x3c0/0x5e0 [ 79.804860][ T5232] ? __pfx_lock_release+0x10/0x10 [ 79.809889][ T5232] ? __pfx___might_resched+0x10/0x10 [ 79.815185][ T5232] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 79.820565][ T5232] lock_sock_nested+0x4b/0xf0 [ 79.825253][ T5232] ? sco_connect_cfm+0x3ee/0xc10 [ 79.830199][ T5232] sco_connect_cfm+0x3ee/0xc10 [ 79.834978][ T5232] ? __pfx_sco_connect_cfm+0x10/0x10 [ 79.840280][ T5232] ? __pfx_sco_connect_cfm+0x10/0x10 [ 79.845572][ T5232] hci_sync_conn_complete_evt+0x3a1/0xa10 [ 79.851302][ T5232] hci_event_packet+0x9eb/0x1180 [ 79.856248][ T5232] ? __pfx_hci_sync_conn_complete_evt+0x10/0x10 [ 79.862493][ T5232] ? __pfx_hci_event_packet+0x10/0x10 [ 79.867870][ T5232] ? mark_held_locks+0x9f/0xe0 [ 79.872642][ T5232] ? kcov_remote_start+0x3cf/0x6e0 [ 79.877759][ T5232] ? lockdep_hardirqs_on+0x7c/0x110 [ 79.882967][ T5232] hci_rx_work+0x2c6/0x1610 [ 79.887471][ T5232] process_one_work+0x9c5/0x1b40 [ 79.892418][ T5232] ? __pfx_lock_acquire+0x10/0x10 [ 79.897446][ T5232] ? __pfx_process_one_work+0x10/0x10 [ 79.902826][ T5232] ? assign_work+0x1a0/0x250 [pid 5249] close(14 [pid 5248] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5246] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5222] mkdir("./1", 0777 [pid 5250] close(14 [pid 5249] <... close resumed>) = -1 EBADF (Bad file descriptor) [ 79.907420][ T5232] worker_thread+0x6c8/0xed0 [ 79.912019][ T5232] ? __pfx_worker_thread+0x10/0x10 [ 79.917135][ T5232] kthread+0x2c1/0x3a0 [ 79.921206][ T5232] ? _raw_spin_unlock_irq+0x23/0x50 [ 79.926413][ T5232] ? __pfx_kthread+0x10/0x10 [ 79.931001][ T5232] ret_from_fork+0x45/0x80 [ 79.935427][ T5232] ? __pfx_kthread+0x10/0x10 [ 79.940014][ T5232] ret_from_fork_asm+0x1a/0x30 [ 79.944788][ T5232] [ 79.948335][ T5232] ================================================================== [ 79.956404][ T5232] BUG: KASAN: slab-use-after-free in __lock_acquire+0x2de0/0x3cb0 [ 79.964211][ T5232] Read of size 8 at addr ffff88807e7351d8 by task kworker/u9:4/5232 [ 79.972180][ T5232] [ 79.974496][ T5232] CPU: 0 UID: 0 PID: 5232 Comm: kworker/u9:4 Tainted: G W 6.11.0-rc5-syzkaller #0 [ 79.985081][ T5232] Tainted: [W]=WARN [ 79.988873][ T5232] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024 [ 79.998922][ T5232] Workqueue: hci4 hci_rx_work [ 80.003597][ T5232] Call Trace: [ 80.006866][ T5232] [ 80.009792][ T5232] dump_stack_lvl+0x116/0x1f0 [ 80.014468][ T5232] print_report+0xc3/0x620 [ 80.018885][ T5232] ? __virt_addr_valid+0x5e/0x590 [ 80.023918][ T5232] ? __phys_addr+0xc6/0x150 [ 80.028419][ T5232] kasan_report+0xd9/0x110 [ 80.032836][ T5232] ? __lock_acquire+0x2de0/0x3cb0 [ 80.037860][ T5232] ? __lock_acquire+0x2de0/0x3cb0 [ 80.042882][ T5232] __lock_acquire+0x2de0/0x3cb0 [ 80.047739][ T5232] ? __pfx_mark_lock+0x10/0x10 [ 80.052505][ T5232] ? __pfx___lock_acquire+0x10/0x10 [ 80.057700][ T5232] ? irqentry_exit+0x3b/0x90 [ 80.062291][ T5232] ? lockdep_hardirqs_on+0x7c/0x110 [ 80.067492][ T5232] lock_acquire+0x1b1/0x560 [ 80.071995][ T5232] ? lock_sock_nested+0x5f/0xf0 [ 80.076855][ T5232] ? __pfx_lock_acquire+0x10/0x10 [ 80.081893][ T5232] ? dump_stack_lvl+0x1a3/0x1f0 [ 80.086746][ T5232] ? add_taint+0x5f/0xd0 [ 80.091000][ T5232] ? __might_resched+0x3cc/0x5e0 [ 80.095956][ T5232] ? __pfx_lock_release+0x10/0x10 [ 80.100979][ T5232] ? __pfx___might_resched+0x10/0x10 [ 80.106269][ T5232] _raw_spin_lock_bh+0x33/0x40 [ 80.111043][ T5232] ? lock_sock_nested+0x5f/0xf0 [ 80.115906][ T5232] lock_sock_nested+0x5f/0xf0 [ 80.120585][ T5232] ? sco_connect_cfm+0x3ee/0xc10 [ 80.125529][ T5232] sco_connect_cfm+0x3ee/0xc10 [ 80.130297][ T5232] ? __pfx_sco_connect_cfm+0x10/0x10 [ 80.135597][ T5232] ? __pfx_sco_connect_cfm+0x10/0x10 [ 80.140884][ T5232] hci_sync_conn_complete_evt+0x3a1/0xa10 [ 80.146608][ T5232] hci_event_packet+0x9eb/0x1180 [ 80.151550][ T5232] ? __pfx_hci_sync_conn_complete_evt+0x10/0x10 [ 80.157791][ T5232] ? __pfx_hci_event_packet+0x10/0x10 [ 80.163166][ T5232] ? mark_held_locks+0x9f/0xe0 [ 80.167928][ T5232] ? kcov_remote_start+0x3cf/0x6e0 [ 80.173040][ T5232] ? lockdep_hardirqs_on+0x7c/0x110 [ 80.178240][ T5232] hci_rx_work+0x2c6/0x1610 [ 80.182741][ T5232] process_one_work+0x9c5/0x1b40 [ 80.187683][ T5232] ? __pfx_lock_acquire+0x10/0x10 [ 80.192710][ T5232] ? __pfx_process_one_work+0x10/0x10 [ 80.198098][ T5232] ? assign_work+0x1a0/0x250 [ 80.202700][ T5232] worker_thread+0x6c8/0xed0 [ 80.207313][ T5232] ? __pfx_worker_thread+0x10/0x10 [ 80.212437][ T5232] kthread+0x2c1/0x3a0 [ 80.216683][ T5232] ? _raw_spin_unlock_irq+0x23/0x50 [ 80.221900][ T5232] ? __pfx_kthread+0x10/0x10 [ 80.226494][ T5232] ret_from_fork+0x45/0x80 [ 80.230924][ T5232] ? __pfx_kthread+0x10/0x10 [ 80.235515][ T5232] ret_from_fork_asm+0x1a/0x30 [ 80.240289][ T5232] [ 80.243300][ T5232] [ 80.245874][ T5232] Allocated by task 5246: [ 80.250189][ T5232] kasan_save_stack+0x33/0x60 [ 80.254865][ T5232] kasan_save_track+0x14/0x30 [ 80.259540][ T5232] __kasan_kmalloc+0xaa/0xb0 [ 80.264126][ T5232] __kmalloc_noprof+0x1e8/0x400 [ 80.268980][ T5232] sk_prot_alloc+0x1a8/0x2a0 [ 80.273570][ T5232] sk_alloc+0x36/0xb90 [ 80.277629][ T5232] bt_sock_alloc+0x3b/0x3a0 [ 80.282135][ T5232] sco_sock_create+0xe3/0x3c0 [ 80.286811][ T5232] bt_sock_create+0x182/0x350 [ 80.291489][ T5232] __sock_create+0x32e/0x800 [ 80.296081][ T5232] __sys_socket+0x14f/0x260 [ 80.300585][ T5232] __x64_sys_socket+0x72/0xb0 [ 80.305266][ T5232] do_syscall_64+0xcd/0x250 [ 80.309780][ T5232] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 80.315669][ T5232] [ 80.317985][ T5232] Freed by task 5246: [ 80.321955][ T5232] kasan_save_stack+0x33/0x60 [ 80.326628][ T5232] kasan_save_track+0x14/0x30 [ 80.331301][ T5232] kasan_save_free_info+0x3b/0x60 [ 80.336336][ T5232] poison_slab_object+0xf7/0x160 [ 80.341276][ T5232] __kasan_slab_free+0x32/0x50 [ 80.346034][ T5232] kfree+0x12a/0x3b0 [ 80.349922][ T5232] __sk_destruct+0x5eb/0x720 [ 80.354509][ T5232] sk_destruct+0xc2/0xf0 [ 80.358924][ T5232] __sk_free+0xf4/0x3e0 [ 80.363076][ T5232] sk_free+0x6a/0x90 [ 80.366964][ T5232] sco_sock_kill+0x11a/0x1c0 [ 80.371557][ T5232] sco_sock_release+0x154/0x2d0 [ 80.376406][ T5232] __sock_release+0xb0/0x270 [ 80.380993][ T5232] sock_close+0x1c/0x30 [ 80.385145][ T5232] __fput+0x408/0xbb0 [ 80.389124][ T5232] __fput_sync+0x47/0x50 [ 80.393363][ T5232] __x64_sys_close+0x86/0x100 [ 80.398043][ T5232] do_syscall_64+0xcd/0x250 [ 80.402547][ T5232] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 80.408436][ T5232] [ 80.410750][ T5232] The buggy address belongs to the object at ffff88807e735000 [ 80.410750][ T5232] which belongs to the cache kmalloc-2k of size 2048 [ 80.424795][ T5232] The buggy address is located 472 bytes inside of [ 80.424795][ T5232] freed 2048-byte region [ffff88807e735000, ffff88807e735800) [ 80.438672][ T5232] [ 80.440986][ T5232] The buggy address belongs to the physical page: [ 80.447378][ T5232] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x7e730 [ 80.456217][ T5232] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 80.464795][ T5232] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 80.472342][ T5232] page_type: 0xfdffffff(slab) [ 80.477013][ T5232] raw: 00fff00000000040 ffff888015842000 dead000000000122 0000000000000000 [ 80.485594][ T5232] raw: 0000000000000000 0000000000080008 00000001fdffffff 0000000000000000 [ 80.494176][ T5232] head: 00fff00000000040 ffff888015842000 dead000000000122 0000000000000000 [ 80.502840][ T5232] head: 0000000000000000 0000000000080008 00000001fdffffff 0000000000000000 [ 80.511506][ T5232] head: 00fff00000000003 ffffea0001f9cc01 ffffffffffffffff 0000000000000000 [ 80.520256][ T5232] head: 0000000000000008 0000000000000000 00000000ffffffff 0000000000000000 [ 80.528912][ T5232] page dumped because: kasan: bad access detected [ 80.535319][ T5232] page_owner tracks the page as allocated [ 80.541107][ T5232] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5210, tgid 5210 (strace-static-x), ts 79502271719, free_ts 79437350591 [ 80.562727][ T5232] post_alloc_hook+0x2d1/0x350 [ 80.567494][ T5232] get_page_from_freelist+0x1351/0x2e50 [ 80.573040][ T5232] __alloc_pages_noprof+0x22b/0x2460 [ 80.578327][ T5232] alloc_slab_page+0x4e/0xf0 [ 80.582920][ T5232] new_slab+0x84/0x260 [ 80.586986][ T5232] ___slab_alloc+0xdac/0x1870 [ 80.591832][ T5232] __slab_alloc.constprop.0+0x56/0xb0 [ 80.597202][ T5232] __kmalloc_noprof+0x367/0x400 [ 80.602049][ T5232] sk_prot_alloc+0x1a8/0x2a0 [ 80.606639][ T5232] sk_alloc+0x36/0xb90 [ 80.610704][ T5232] __netlink_create+0x5e/0x2c0 [ 80.615464][ T5232] netlink_create+0x3a4/0x630 [ 80.620139][ T5232] __sock_create+0x32e/0x800 [ 80.624728][ T5232] __sys_socket+0x14f/0x260 [ 80.629325][ T5232] __x64_sys_socket+0x72/0xb0 [ 80.634007][ T5232] do_syscall_64+0xcd/0x250 [ 80.638601][ T5232] page last free pid 5210 tgid 5210 stack trace: [ 80.644998][ T5232] free_unref_page+0x64a/0xe40 [ 80.649757][ T5232] __put_partials+0x14c/0x170 [ 80.654430][ T5232] qlist_free_all+0x4e/0x140 [ 80.659016][ T5232] kasan_quarantine_reduce+0x192/0x1e0 [ 80.664473][ T5232] __kasan_slab_alloc+0x69/0x90 [ 80.669322][ T5232] kmem_cache_alloc_noprof+0x121/0x2f0 [ 80.674779][ T5232] getname_flags.part.0+0x4c/0x550 [ 80.679891][ T5232] getname_flags+0x93/0xf0 [ 80.684312][ T5232] user_path_at+0x24/0x60 [ 80.688635][ T5232] path_getxattr+0x9d/0x1a0 [ 80.693141][ T5232] do_syscall_64+0xcd/0x250 [ 80.697645][ T5232] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 80.703536][ T5232] [ 80.705848][ T5232] Memory state around the buggy address: [ 80.711465][ T5232] ffff88807e735080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 80.719519][ T5232] ffff88807e735100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 80.727571][ T5232] >ffff88807e735180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 80.735618][ T5232] ^ [ 80.742542][ T5232] ffff88807e735200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 80.750597][ T5232] ffff88807e735280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 80.758647][ T5232] ================================================================== [ 80.766693][ T5232] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 80.773878][ T5232] CPU: 0 UID: 0 PID: 5232 Comm: kworker/u9:4 Tainted: G W 6.11.0-rc5-syzkaller #0 [ 80.784463][ T5232] Tainted: [W]=WARN [ 80.788257][ T5232] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024 [ 80.798312][ T5232] Workqueue: hci4 hci_rx_work [ 80.802987][ T5232] Call Trace: [ 80.806260][ T5232] [ 80.809192][ T5232] dump_stack_lvl+0x3d/0x1f0 [ 80.813784][ T5232] panic+0x6dc/0x7c0 [ 80.817707][ T5232] ? __pfx_panic+0x10/0x10 [ 80.822122][ T5232] ? rcu_is_watching+0x12/0xc0 [ 80.826887][ T5232] ? __pfx_lock_release+0x10/0x10 [ 80.831998][ T5232] ? check_panic_on_warn+0x1f/0xb0 [ 80.837109][ T5232] check_panic_on_warn+0xab/0xb0 [ 80.842050][ T5232] end_report+0x117/0x180 [ 80.846381][ T5232] kasan_report+0xe9/0x110 [ 80.850797][ T5232] ? __lock_acquire+0x2de0/0x3cb0 [ 80.855820][ T5232] ? __lock_acquire+0x2de0/0x3cb0 [ 80.860853][ T5232] __lock_acquire+0x2de0/0x3cb0 [ 80.865708][ T5232] ? __pfx_mark_lock+0x10/0x10 [ 80.870475][ T5232] ? __pfx___lock_acquire+0x10/0x10 [ 80.875678][ T5232] ? irqentry_exit+0x3b/0x90 [ 80.880278][ T5232] ? lockdep_hardirqs_on+0x7c/0x110 [ 80.885480][ T5232] lock_acquire+0x1b1/0x560 [ 80.889981][ T5232] ? lock_sock_nested+0x5f/0xf0 [ 80.894832][ T5232] ? __pfx_lock_acquire+0x10/0x10 [ 80.899857][ T5232] ? dump_stack_lvl+0x1a3/0x1f0 [ 80.904704][ T5232] ? add_taint+0x5f/0xd0 [ 80.908947][ T5232] ? __might_resched+0x3cc/0x5e0 [ 80.913888][ T5232] ? __pfx_lock_release+0x10/0x10 [ 80.918912][ T5232] ? __pfx___might_resched+0x10/0x10 [ 80.924201][ T5232] _raw_spin_lock_bh+0x33/0x40 [ 80.928989][ T5232] ? lock_sock_nested+0x5f/0xf0 [ 80.933837][ T5232] lock_sock_nested+0x5f/0xf0 [ 80.938511][ T5232] ? sco_connect_cfm+0x3ee/0xc10 [ 80.943453][ T5232] sco_connect_cfm+0x3ee/0xc10 [ 80.948219][ T5232] ? __pfx_sco_connect_cfm+0x10/0x10 [ 80.953513][ T5232] ? __pfx_sco_connect_cfm+0x10/0x10 [ 80.958804][ T5232] hci_sync_conn_complete_evt+0x3a1/0xa10 [ 80.964527][ T5232] hci_event_packet+0x9eb/0x1180 [ 80.969468][ T5232] ? __pfx_hci_sync_conn_complete_evt+0x10/0x10 [ 80.975716][ T5232] ? __pfx_hci_event_packet+0x10/0x10 [ 80.981093][ T5232] ? mark_held_locks+0x9f/0xe0 [ 80.985857][ T5232] ? kcov_remote_start+0x3cf/0x6e0 [ 80.990976][ T5232] ? lockdep_hardirqs_on+0x7c/0x110 [ 80.996178][ T5232] hci_rx_work+0x2c6/0x1610 [ 81.000683][ T5232] process_one_work+0x9c5/0x1b40 [ 81.005626][ T5232] ? __pfx_lock_acquire+0x10/0x10 [ 81.010650][ T5232] ? __pfx_process_one_work+0x10/0x10 [ 81.016025][ T5232] ? assign_work+0x1a0/0x250 [ 81.020615][ T5232] worker_thread+0x6c8/0xed0 [ 81.025211][ T5232] ? __pfx_worker_thread+0x10/0x10 [ 81.030412][ T5232] kthread+0x2c1/0x3a0 [ 81.034486][ T5232] ? _raw_spin_unlock_irq+0x23/0x50 [ 81.039704][ T5232] ? __pfx_kthread+0x10/0x10 [ 81.044290][ T5232] ret_from_fork+0x45/0x80 [ 81.048713][ T5232] ? __pfx_kthread+0x10/0x10 [ 81.053298][ T5232] ret_from_fork_asm+0x1a/0x30 [ 81.058069][ T5232] [ 81.061325][ T5232] Kernel Offset: disabled [ 81.065632][ T5232] Rebooting in 86400 seconds..