./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor284052916 <...> Warning: Permanently added '10.128.0.112' (ED25519) to the list of known hosts. execve("./syz-executor284052916", ["./syz-executor284052916"], 0x7ffe66ee9870 /* 10 vars */) = 0 brk(NULL) = 0x55557f1c5000 brk(0x55557f1c5d40) = 0x55557f1c5d40 arch_prctl(ARCH_SET_FS, 0x55557f1c53c0) = 0 set_tid_address(0x55557f1c5690) = 289 set_robust_list(0x55557f1c56a0, 24) = 0 rseq(0x55557f1c5ce0, 0x20, 0, 0x53053053) = -1 ENOSYS (Function not implemented) prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 readlink("/proc/self/exe", "/root/syz-executor284052916", 4096) = 27 getrandom("\xe4\xd2\xbb\x83\xe6\xb0\xad\xa5", 8, GRND_NONBLOCK) = 8 brk(NULL) = 0x55557f1c5d40 brk(0x55557f1e6d40) = 0x55557f1e6d40 brk(0x55557f1e7000) = 0x55557f1e7000 mprotect(0x7f42eb318000, 16384, PROT_READ) = 0 mmap(0x1ffffffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffffffff000 mmap(0x200000000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200000000000 mmap(0x200001000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200001000000 unshare(CLONE_NEWPID) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55557f1c5690) = 290 ./strace-static-x86_64: Process 290 attached [pid 290] set_robust_list(0x55557f1c56a0, 24) = 0 [pid 290] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 290] getppid() = 0 [pid 290] openat(AT_FDCWD, "/proc/self/ns/net", O_RDONLY) = 3 [pid 290] dup2(3, 201) = 201 [pid 290] close(3) = 0 [pid 290] prlimit64(0, RLIMIT_AS, {rlim_cur=204800*1024, rlim_max=204800*1024}, NULL) = 0 [pid 290] prlimit64(0, RLIMIT_MEMLOCK, {rlim_cur=32768*1024, rlim_max=32768*1024}, NULL) = 0 [pid 290] prlimit64(0, RLIMIT_FSIZE, {rlim_cur=139264*1024, rlim_max=139264*1024}, NULL) = 0 [pid 290] prlimit64(0, RLIMIT_STACK, {rlim_cur=1024*1024, rlim_max=1024*1024}, NULL) = 0 [pid 290] prlimit64(0, RLIMIT_CORE, {rlim_cur=131072*1024, rlim_max=131072*1024}, NULL) = 0 [pid 290] prlimit64(0, RLIMIT_NOFILE, {rlim_cur=256, rlim_max=256}, NULL) = 0 [pid 290] unshare(CLONE_NEWNS) = 0 [pid 290] mount(NULL, "/", NULL, MS_REC|MS_PRIVATE, NULL) = 0 [pid 290] unshare(CLONE_NEWIPC) = -1 EINVAL (Invalid argument) [pid 290] unshare(CLONE_NEWCGROUP) = 0 [pid 290] unshare(CLONE_NEWUTS) = 0 [pid 290] unshare(CLONE_SYSVSEM) = 0 [pid 290] openat(AT_FDCWD, "/proc/sys/kernel/shmmax", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) [pid 290] openat(AT_FDCWD, "/proc/sys/kernel/shmall", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) [pid 290] openat(AT_FDCWD, "/proc/sys/kernel/shmmni", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) [pid 290] openat(AT_FDCWD, "/proc/sys/kernel/msgmax", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) [pid 290] openat(AT_FDCWD, "/proc/sys/kernel/msgmni", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) [pid 290] openat(AT_FDCWD, "/proc/sys/kernel/msgmnb", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) [pid 290] openat(AT_FDCWD, "/proc/sys/kernel/sem", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) [pid 290] getpid() = 1 [pid 290] capget({version=_LINUX_CAPABILITY_VERSION_3, pid=1}, {effective=1< {parent_tid=[3]}, 88) = 3 [pid 291] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 291] futex(0x7f42eb31e328, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 291] futex(0x7f42eb31e32c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 292 attached [pid 292] set_robust_list(0x7f42eb2549a0, 24) = 0 [pid 292] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 292] openat(AT_FDCWD, "/proc/self/ns/net", O_RDONLY) = 3 [pid 292] setns(201, 0) = 0 [pid 292] socket(AF_BLUETOOTH, SOCK_RAW, BTPROTO_HCI) = 4 [pid 292] setns(3, 0) = 0 [pid 292] close(3) = 0 [pid 292] futex(0x7f42eb31e32c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 291] <... futex resumed>) = 0 [pid 291] futex(0x7f42eb31e328, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 291] futex(0x7f42eb31e32c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 292] openat(AT_FDCWD, "/dev/ptmx", O_RDONLY) = 3 [pid 292] futex(0x7f42eb31e32c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 291] <... futex resumed>) = 0 [pid 291] futex(0x7f42eb31e328, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 291] futex(0x7f42eb31e32c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 292] ioctl(3, TIOCSETD, [15]) = 0 [pid 292] futex(0x7f42eb31e32c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 291] <... futex resumed>) = 0 [pid 291] futex(0x7f42eb31e328, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 291] futex(0x7f42eb31e32c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 292] ioctl(3, _IOC(_IOC_WRITE, 0x55, 0xc8, 0x4), 0) = 0 [pid 292] futex(0x7f42eb31e32c, FUTEX_WAKE_PRIVATE, 1000000 [pid 291] <... futex resumed>) = 0 [pid 291] futex(0x7f42eb31e328, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 291] futex(0x7f42eb31e32c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 292] <... futex resumed>) = 1 [ 25.602027][ T28] audit: type=1400 audit(1750226929.494:66): avc: denied { open } for pid=290 comm="syz-executor284" path="net:[4026531840]" dev="nsfs" ino=4026531840 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 25.604639][ T290] request_module fs-gadgetfs succeeded, but still no fs? [ 25.626870][ T28] audit: type=1400 audit(1750226929.504:67): avc: denied { mounton } for pid=290 comm="syz-executor284" path="/" dev="sda1" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:root_t tclass=dir permissive=1 [ 25.655201][ T28] audit: type=1400 audit(1750226929.524:68): avc: denied { mounton } for pid=290 comm="syz-executor284" path="/root/syz-tmp" dev="sda1" ino=2024 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_home_t tclass=dir permissive=1 [ 25.678232][ T28] audit: type=1400 audit(1750226929.524:69): avc: denied { mount } for pid=290 comm="syz-executor284" name="/" dev="tmpfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [pid 292] ioctl(4, HCISETLINKPOL [pid 291] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [ 25.700625][ T28] audit: type=1400 audit(1750226929.524:70): avc: denied { mounton } for pid=290 comm="syz-executor284" path="/root/syz-tmp/newroot/dev" dev="tmpfs" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1 [ 25.724613][ T28] audit: type=1400 audit(1750226929.524:71): avc: denied { mount } for pid=290 comm="syz-executor284" name="/" dev="proc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_t tclass=filesystem permissive=1 [ 25.746798][ T28] audit: type=1400 audit(1750226929.524:72): avc: denied { mounton } for pid=290 comm="syz-executor284" path="/root/syz-tmp/newroot/sys/kernel/debug" dev="debugfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=dir permissive=1 [ 25.772126][ T28] audit: type=1400 audit(1750226929.524:73): avc: denied { mounton } for pid=290 comm="syz-executor284" path="/root/syz-tmp/newroot/proc/sys/fs/binfmt_misc" dev="proc" ino=15001 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysctl_fs_t tclass=dir permissive=1 [pid 291] close(3 [pid 292] <... ioctl resumed>, 0x2000000003c0) = -1 ETIMEDOUT (Connection timed out) [pid 292] futex(0x7f42eb31e32c, FUTEX_WAKE_PRIVATE, 1000000 [pid 291] <... close resumed>) = 0 [pid 292] <... futex resumed>) = 0 [pid 291] close(4 [pid 292] futex(0x7f42eb31e328, FUTEX_WAIT_PRIVATE, 0, NULL [pid 291] <... close resumed>) = 0 [pid 291] close(5) = -1 EBADF (Bad file descriptor) [pid 291] close(6) = -1 EBADF (Bad file descriptor) [pid 291] close(7) = -1 EBADF (Bad file descriptor) [pid 291] close(8) = -1 EBADF (Bad file descriptor) [pid 291] close(9) = -1 EBADF (Bad file descriptor) [pid 291] close(10) = -1 EBADF (Bad file descriptor) [pid 291] close(11) = -1 EBADF (Bad file descriptor) [pid 291] close(12) = -1 EBADF (Bad file descriptor) [pid 291] close(13) = -1 EBADF (Bad file descriptor) [pid 291] close(14) = -1 EBADF (Bad file descriptor) [pid 291] close(15) = -1 EBADF (Bad file descriptor) [pid 291] close(16) = -1 EBADF (Bad file descriptor) [pid 291] close(17) = -1 EBADF (Bad file descriptor) [pid 291] close(18) = -1 EBADF (Bad file descriptor) [pid 291] close(19) = -1 EBADF (Bad file descriptor) [pid 291] close(20) = -1 EBADF (Bad file descriptor) [pid 291] close(21) = -1 EBADF (Bad file descriptor) [pid 291] close(22) = -1 EBADF (Bad file descriptor) [pid 291] close(23) = -1 EBADF (Bad file descriptor) [pid 291] close(24) = -1 EBADF (Bad file descriptor) [pid 291] close(25) = -1 EBADF (Bad file descriptor) [pid 291] close(26) = -1 EBADF (Bad file descriptor) [pid 291] close(27) = -1 EBADF (Bad file descriptor) [pid 291] close(28) = -1 EBADF (Bad file descriptor) [pid 291] close(29) = -1 EBADF (Bad file descriptor) [pid 291] exit_group(0 [pid 292] <... futex resumed>) = ? [pid 291] <... exit_group resumed>) = ? [pid 292] +++ exited with 0 +++ [pid 291] +++ exited with 0 +++ [pid 290] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=2, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 290] restart_syscall(<... resuming interrupted clone ...>) = 0 [pid 290] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55557f1c5690) = 4 ./strace-static-x86_64: Process 296 attached [pid 296] set_robust_list(0x55557f1c56a0, 24) = 0 [pid 296] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 296] setpgid(0, 0) = 0 [pid 296] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 296] write(3, "1000", 4) = 4 executing program [pid 296] close(3) = 0 [pid 296] write(1, "executing program\n", 18) = 18 [pid 296] futex(0x7f42eb31e32c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 296] rt_sigaction(SIGRT_1, {sa_handler=0x7f42eb2b9ae0, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f42eb2ab160}, NULL, 8) = 0 [pid 296] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 296] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f42eb234000 [pid 296] mprotect(0x7f42eb235000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 296] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 296] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f42eb254990, parent_tid=0x7f42eb254990, exit_signal=0, stack=0x7f42eb234000, stack_size=0x20300, tls=0x7f42eb2546c0} => {parent_tid=[5]}, 88) = 5 ./strace-static-x86_64: Process 297 attached [pid 296] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 296] futex(0x7f42eb31e328, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 296] futex(0x7f42eb31e32c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 297] set_robust_list(0x7f42eb2549a0, 24) = 0 [pid 297] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 297] openat(AT_FDCWD, "/proc/self/ns/net", O_RDONLY) = 3 [pid 297] setns(201, 0) = 0 [pid 297] socket(AF_BLUETOOTH, SOCK_RAW, BTPROTO_HCI) = 4 [pid 297] setns(3, 0) = 0 [pid 297] close(3) = 0 [pid 297] futex(0x7f42eb31e32c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 296] <... futex resumed>) = 0 [pid 297] openat(AT_FDCWD, "/dev/ptmx", O_RDONLY [pid 296] futex(0x7f42eb31e328, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 297] <... openat resumed>) = 3 [pid 296] futex(0x7f42eb31e32c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 297] futex(0x7f42eb31e32c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 296] <... futex resumed>) = 0 [pid 297] ioctl(3, TIOCSETD, [15] [pid 296] futex(0x7f42eb31e328, FUTEX_WAKE_PRIVATE, 1000000 [pid 297] <... ioctl resumed>) = 0 [pid 296] <... futex resumed>) = 0 [pid 296] futex(0x7f42eb31e32c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 297] futex(0x7f42eb31e32c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 296] <... futex resumed>) = 0 [pid 297] ioctl(3, _IOC(_IOC_WRITE, 0x55, 0xc8, 0x4) [pid 296] futex(0x7f42eb31e328, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 296] futex(0x7f42eb31e32c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 297] <... ioctl resumed>, 0) = 0 [pid 297] futex(0x7f42eb31e32c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 297] futex(0x7f42eb31e328, FUTEX_WAIT_PRIVATE, 0, NULL [pid 296] <... futex resumed>) = 0 [pid 296] futex(0x7f42eb31e328, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 296] futex(0x7f42eb31e32c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 297] <... futex resumed>) = 0 [pid 297] ioctl(4, HCISETLINKPOL [pid 296] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [ 27.692947][ T292] Bluetooth: hci0: Opcode 0x080f failed: -110 [ 27.720991][ T43] Bluetooth: hci0: Frame reassembly failed (-84) [pid 296] futex(0x7f42eb31e32c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=0}) = -1 ETIMEDOUT (Connection timed out) [pid 296] futex(0x7f42eb31e32c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=0}) = -1 ETIMEDOUT (Connection timed out) [pid 296] close(3 [pid 297] <... ioctl resumed>, 0x2000000003c0) = -1 EINVAL (Invalid argument) [pid 296] <... close resumed>) = 0 [pid 296] close(4 [pid 297] futex(0x7f42eb31e32c, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] <... close resumed>) = 0 [pid 297] <... futex resumed>) = 0 [pid 297] futex(0x7f42eb31e328, FUTEX_WAIT_PRIVATE, 0, NULL [pid 296] close(5) = -1 EBADF (Bad file descriptor) [pid 296] close(6) = -1 EBADF (Bad file descriptor) [pid 296] close(7) = -1 EBADF (Bad file descriptor) [pid 296] close(8) = -1 EBADF (Bad file descriptor) [pid 296] close(9) = -1 EBADF (Bad file descriptor) [pid 296] close(10) = -1 EBADF (Bad file descriptor) [pid 296] close(11) = -1 EBADF (Bad file descriptor) [pid 296] close(12) = -1 EBADF (Bad file descriptor) [pid 296] close(13) = -1 EBADF (Bad file descriptor) [pid 296] close(14) = -1 EBADF (Bad file descriptor) [pid 296] close(15) = -1 EBADF (Bad file descriptor) [pid 296] close(16) = -1 EBADF (Bad file descriptor) [pid 296] close(17) = -1 EBADF (Bad file descriptor) [pid 296] close(18) = -1 EBADF (Bad file descriptor) [pid 296] close(19) = -1 EBADF (Bad file descriptor) [pid 296] close(20) = -1 EBADF (Bad file descriptor) [pid 296] close(21) = -1 EBADF (Bad file descriptor) [pid 296] close(22) = -1 EBADF (Bad file descriptor) [pid 296] close(23) = -1 EBADF (Bad file descriptor) [pid 296] close(24) = -1 EBADF (Bad file descriptor) [pid 296] close(25) = -1 EBADF (Bad file descriptor) [pid 296] close(26) = -1 EBADF (Bad file descriptor) [pid 296] close(27) = -1 EBADF (Bad file descriptor) [pid 296] close(28) = -1 EBADF (Bad file descriptor) [pid 296] close(29) = -1 EBADF (Bad file descriptor) [pid 296] exit_group(0 [pid 297] <... futex resumed>) = ? [pid 296] <... exit_group resumed>) = ? [pid 297] +++ exited with 0 +++ [pid 296] +++ exited with 0 +++ [pid 290] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=4, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 290] restart_syscall(<... resuming interrupted clone ...>) = 0 [pid 290] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55557f1c5690) = 6 ./strace-static-x86_64: Process 298 attached [pid 298] set_robust_list(0x55557f1c56a0, 24) = 0 [pid 298] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 298] setpgid(0, 0) = 0 [pid 298] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 298] write(3, "1000", 4) = 4 [pid 298] close(3) = 0 [pid 298] write(1, "executing program\n", 18executing program ) = 18 [pid 298] futex(0x7f42eb31e32c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 298] rt_sigaction(SIGRT_1, {sa_handler=0x7f42eb2b9ae0, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f42eb2ab160}, NULL, 8) = 0 [pid 298] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 298] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f42eb234000 [pid 298] mprotect(0x7f42eb235000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 298] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 298] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f42eb254990, parent_tid=0x7f42eb254990, exit_signal=0, stack=0x7f42eb234000, stack_size=0x20300, tls=0x7f42eb2546c0} => {parent_tid=[7]}, 88) = 7 [pid 298] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 298] futex(0x7f42eb31e328, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 298] futex(0x7f42eb31e32c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 299 attached [pid 299] set_robust_list(0x7f42eb2549a0, 24) = 0 [pid 299] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 299] openat(AT_FDCWD, "/proc/self/ns/net", O_RDONLY) = 3 [pid 299] setns(201, 0) = 0 [pid 299] socket(AF_BLUETOOTH, SOCK_RAW, BTPROTO_HCI) = 4 [pid 299] setns(3, 0) = 0 [pid 299] close(3) = 0 [pid 299] futex(0x7f42eb31e32c, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] <... futex resumed>) = 0 [pid 298] futex(0x7f42eb31e328, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 298] futex(0x7f42eb31e32c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 299] <... futex resumed>) = 1 [pid 299] openat(AT_FDCWD, "/dev/ptmx", O_RDONLY) = 3 [pid 299] futex(0x7f42eb31e32c, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] <... futex resumed>) = 0 [pid 298] futex(0x7f42eb31e328, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 298] futex(0x7f42eb31e32c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 299] <... futex resumed>) = 1 [pid 299] ioctl(3, TIOCSETD, [15]) = 0 [pid 299] futex(0x7f42eb31e32c, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] <... futex resumed>) = 0 [pid 299] <... futex resumed>) = 1 [pid 298] futex(0x7f42eb31e328, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 298] futex(0x7f42eb31e32c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 299] ioctl(3, _IOC(_IOC_WRITE, 0x55, 0xc8, 0x4), 0) = 0 [pid 299] futex(0x7f42eb31e32c, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] <... futex resumed>) = 0 [pid 298] futex(0x7f42eb31e328, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 298] futex(0x7f42eb31e32c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 299] <... futex resumed>) = 1 [ 29.773022][ T45] Bluetooth: hci0: Opcode 0x1003 failed: -110 [ 29.773022][ T295] Bluetooth: hci0: command 0x1003 tx timeout [ 29.785334][ T297] Bluetooth: hci0: Opcode 0x080f failed: -22 [ 29.807561][ T43] Bluetooth: hci0: Frame reassembly failed (-84) [pid 299] ioctl(4, HCISETLINKPOL [pid 298] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 298] futex(0x7f42eb31e32c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=0}) = -1 ETIMEDOUT (Connection timed out) [pid 298] futex(0x7f42eb31e32c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=0}) = -1 ETIMEDOUT (Connection timed out) [pid 298] futex(0x7f42eb31e32c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=0}) = -1 ETIMEDOUT (Connection timed out) [pid 298] close(3) = 0 [pid 298] close(4) = 0 [pid 298] close(5) = -1 EBADF (Bad file descriptor) [pid 298] close(6) = -1 EBADF (Bad file descriptor) [pid 298] close(7) = -1 EBADF (Bad file descriptor) [pid 298] close(8) = -1 EBADF (Bad file descriptor) [pid 298] close(9) = -1 EBADF (Bad file descriptor) [pid 298] close(10) = -1 EBADF (Bad file descriptor) [pid 298] close(11) = -1 EBADF (Bad file descriptor) [pid 298] close(12) = -1 EBADF (Bad file descriptor) [pid 298] close(13) = -1 EBADF (Bad file descriptor) [pid 298] close(14) = -1 EBADF (Bad file descriptor) [pid 298] close(15) = -1 EBADF (Bad file descriptor) [pid 298] close(16) = -1 EBADF (Bad file descriptor) [pid 298] close(17) = -1 EBADF (Bad file descriptor) [pid 298] close(18) = -1 EBADF (Bad file descriptor) [pid 298] close(19) = -1 EBADF (Bad file descriptor) [pid 298] close(20) = -1 EBADF (Bad file descriptor) [pid 298] close(21) = -1 EBADF (Bad file descriptor) [pid 298] close(22) = -1 EBADF (Bad file descriptor) [pid 298] close(23) = -1 EBADF (Bad file descriptor) [pid 298] close(24) = -1 EBADF (Bad file descriptor) [pid 298] close(25) = -1 EBADF (Bad file descriptor) [pid 298] close(26) = -1 EBADF (Bad file descriptor) [pid 298] close(27) = -1 EBADF (Bad file descriptor) [pid 298] close(28) = -1 EBADF (Bad file descriptor) [pid 298] close(29) = -1 EBADF (Bad file descriptor) [pid 298] exit_group(0) = ? [pid 299] <... ioctl resumed> ) = ? [pid 299] +++ exited with 0 +++ [pid 298] +++ exited with 0 +++ [pid 290] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=6, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 290] restart_syscall(<... resuming interrupted clone ...>) = 0 [pid 290] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55557f1c5690) = 8 ./strace-static-x86_64: Process 300 attached [pid 300] set_robust_list(0x55557f1c56a0, 24) = 0 [pid 300] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 300] setpgid(0, 0) = 0 [pid 300] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 300] write(3, "1000", 4) = 4 [pid 300] close(3) = 0 executing program [pid 300] write(1, "executing program\n", 18) = 18 [pid 300] futex(0x7f42eb31e32c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 300] rt_sigaction(SIGRT_1, {sa_handler=0x7f42eb2b9ae0, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f42eb2ab160}, NULL, 8) = 0 [pid 300] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 300] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f42eb234000 [pid 300] mprotect(0x7f42eb235000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 300] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 300] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f42eb254990, parent_tid=0x7f42eb254990, exit_signal=0, stack=0x7f42eb234000, stack_size=0x20300, tls=0x7f42eb2546c0} => {parent_tid=[9]}, 88) = 9 [pid 300] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 300] futex(0x7f42eb31e328, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 300] futex(0x7f42eb31e32c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 301 attached [pid 301] set_robust_list(0x7f42eb2549a0, 24) = 0 [pid 301] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 301] openat(AT_FDCWD, "/proc/self/ns/net", O_RDONLY) = 3 [pid 301] setns(201, 0) = 0 [pid 301] socket(AF_BLUETOOTH, SOCK_RAW, BTPROTO_HCI) = 4 [pid 301] setns(3, 0) = 0 [pid 301] close(3) = 0 [pid 301] futex(0x7f42eb31e32c, FUTEX_WAKE_PRIVATE, 1000000 [pid 300] <... futex resumed>) = 0 [pid 300] futex(0x7f42eb31e328, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 300] futex(0x7f42eb31e32c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 301] <... futex resumed>) = 1 [pid 301] openat(AT_FDCWD, "/dev/ptmx", O_RDONLY) = 3 [pid 301] futex(0x7f42eb31e32c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 300] <... futex resumed>) = 0 [pid 301] futex(0x7f42eb31e328, FUTEX_WAIT_PRIVATE, 0, NULL [pid 300] futex(0x7f42eb31e328, FUTEX_WAKE_PRIVATE, 1000000 [pid 301] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 300] <... futex resumed>) = 0 [pid 300] futex(0x7f42eb31e32c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 301] ioctl(3, TIOCSETD, [15]) = 0 [pid 301] futex(0x7f42eb31e32c, FUTEX_WAKE_PRIVATE, 1000000 [pid 300] <... futex resumed>) = 0 [pid 300] futex(0x7f42eb31e328, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 300] futex(0x7f42eb31e32c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 301] <... futex resumed>) = 1 [ 31.853008][ T294] Bluetooth: hci0: command 0x1003 tx timeout [ 31.853004][ T45] Bluetooth: hci0: Opcode 0x1003 failed: -110 [ 31.865240][ T299] Bluetooth: hci0: Opcode 0x080f failed: -22 [ 31.888719][ T45] ================================================================== [ 31.896859][ T45] BUG: KASAN: use-after-free in enqueue_timer+0xae/0x480 [ 31.903919][ T45] Write of size 8 at addr ffff888116b90a00 by task kworker/u5:0/45 [ 31.911798][ T45] [ 31.914119][ T45] CPU: 0 PID: 45 Comm: kworker/u5:0 Not tainted 6.1.138-syzkaller-00010-gba4506940166 #0 [ 31.923907][ T45] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 31.933954][ T45] Workqueue: hci0 hci_power_on [ 31.938736][ T45] Call Trace: [ 31.942016][ T45] [ 31.944975][ T45] __dump_stack+0x21/0x24 [ 31.949335][ T45] dump_stack_lvl+0xee/0x150 [ 31.953920][ T45] ? __cfi_dump_stack_lvl+0x8/0x8 [ 31.958947][ T45] ? select_task_rq_fair+0x56f/0x3490 [ 31.964323][ T45] ? enqueue_timer+0xae/0x480 [ 31.969018][ T45] print_address_description+0x71/0x210 [ 31.974566][ T45] print_report+0x4a/0x60 [ 31.978912][ T45] kasan_report+0x122/0x150 [ 31.983496][ T45] ? enqueue_timer+0xae/0x480 [ 31.988169][ T45] ? try_to_wake_up+0x613/0x1220 [ 31.993100][ T45] __asan_report_store8_noabort+0x17/0x20 [ 31.998817][ T45] enqueue_timer+0xae/0x480 [ 32.003329][ T45] __mod_timer+0x79f/0xb30 [ 32.007755][ T45] schedule_timeout+0x127/0x2e0 [ 32.012612][ T45] ? __cfi_schedule_timeout+0x10/0x10 [ 32.017984][ T45] ? queue_work_on+0xf8/0x140 [ 32.022661][ T45] ? __cfi_process_timeout+0x10/0x10 [ 32.027941][ T45] ? prepare_to_wait_event+0x40b/0x440 [ 32.033395][ T45] __hci_cmd_sync_sk+0x396/0xcf0 [ 32.038320][ T45] ? __cfi___hci_cmd_sync_sk+0x10/0x10 [ 32.043765][ T45] ? __cfi_autoremove_wake_function+0x10/0x10 [ 32.049829][ T45] ? __kasan_check_read+0x11/0x20 [ 32.054854][ T45] ? kvm_sched_clock_read+0x18/0x40 [ 32.060049][ T45] hci_dev_open_sync+0x13a7/0x3260 [ 32.065249][ T45] ? __cfi_hci_dev_open_sync+0x10/0x10 [ 32.070747][ T45] ? __kasan_check_write+0x14/0x20 [ 32.075963][ T45] ? __switch_to+0x51f/0xe30 [ 32.080564][ T45] ? psi_group_change+0xb73/0x12b0 [ 32.085776][ T45] ? __kasan_check_write+0x14/0x20 [ 32.090895][ T45] ? mutex_lock+0x8d/0x1a0 [ 32.095302][ T45] ? __cfi_mutex_lock+0x10/0x10 [ 32.100157][ T45] ? kthread_data+0x50/0xc0 [ 32.104660][ T45] ? _raw_spin_unlock+0x4c/0x70 [ 32.109514][ T45] hci_power_on+0x195/0x5c0 [ 32.114007][ T45] ? __cfi_hci_power_on+0x10/0x10 [ 32.119043][ T45] ? __schedule+0xb8f/0x14e0 [ 32.123631][ T45] ? __cfi__raw_spin_lock_irq+0x10/0x10 [ 32.129174][ T45] process_one_work+0x71f/0xc40 [ 32.134022][ T45] worker_thread+0xa29/0x11f0 [ 32.138694][ T45] kthread+0x281/0x320 [ 32.142754][ T45] ? __cfi_worker_thread+0x10/0x10 [ 32.147868][ T45] ? __cfi_kthread+0x10/0x10 [ 32.152445][ T45] ret_from_fork+0x1f/0x30 [ 32.156856][ T45] [ 32.159863][ T45] [ 32.162188][ T45] Allocated by task 299: [ 32.166410][ T45] kasan_set_track+0x4b/0x70 [ 32.170987][ T45] kasan_save_alloc_info+0x25/0x30 [ 32.176095][ T45] __kasan_kmalloc+0x95/0xb0 [ 32.180676][ T45] __kmalloc+0xb1/0x1e0 [ 32.184825][ T45] hci_alloc_dev_priv+0x27/0x1bd0 [ 32.189840][ T45] hci_uart_tty_ioctl+0x3d6/0xa20 [ 32.194859][ T45] tty_ioctl+0x8ef/0xc60 [ 32.199089][ T45] __se_sys_ioctl+0x12f/0x1b0 [ 32.203760][ T45] __x64_sys_ioctl+0x7b/0x90 [ 32.208345][ T45] x64_sys_call+0x58b/0x9a0 [ 32.212837][ T45] do_syscall_64+0x4c/0xa0 [ 32.217292][ T45] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 32.223197][ T45] [ 32.225509][ T45] Freed by task 299: [ 32.229384][ T45] kasan_set_track+0x4b/0x70 [ 32.233960][ T45] kasan_save_free_info+0x31/0x50 [ 32.238980][ T45] ____kasan_slab_free+0x132/0x180 [ 32.244085][ T45] __kasan_slab_free+0x11/0x20 [ 32.248839][ T45] slab_free_freelist_hook+0xc2/0x190 [ 32.254205][ T45] __kmem_cache_free+0xb7/0x1b0 [ 32.259045][ T45] kfree+0x6f/0xf0 [ 32.262756][ T45] hci_release_dev+0x13ad/0x1500 [ 32.267684][ T45] bt_host_release+0x82/0x90 [ 32.272263][ T45] device_release+0xa4/0x1d0 [ 32.276838][ T45] kobject_put+0x19d/0x280 [ 32.281240][ T45] put_device+0x1f/0x30 [ 32.285385][ T45] hci_dev_cmd+0x265/0x720 [ 32.289806][ T45] hci_sock_ioctl+0x41e/0x7f0 [ 32.294561][ T45] sock_do_ioctl+0x101/0x310 [ 32.299143][ T45] sock_ioctl+0x4d8/0x6e0 [ 32.303461][ T45] __se_sys_ioctl+0x12f/0x1b0 [ 32.308156][ T45] __x64_sys_ioctl+0x7b/0x90 [ 32.312781][ T45] x64_sys_call+0x58b/0x9a0 [ 32.317272][ T45] do_syscall_64+0x4c/0xa0 [ 32.321698][ T45] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 32.327611][ T45] [ 32.329948][ T45] Last potentially related work creation: [ 32.335645][ T45] kasan_save_stack+0x3a/0x60 [ 32.340328][ T45] __kasan_record_aux_stack+0xb6/0xc0 [ 32.345716][ T45] kasan_record_aux_stack_noalloc+0xb/0x10 [ 32.351514][ T45] insert_work+0x51/0x300 [ 32.355842][ T45] __queue_work+0x9b1/0xd30 [ 32.360414][ T45] queue_work_on+0xd2/0x140 [ 32.364935][ T45] __hci_cmd_sync_sk+0xa3e/0xcf0 [ 32.369872][ T45] hci_cmd_sync_status+0x53/0x120 [ 32.374908][ T45] hci_dev_cmd+0x628/0x720 [ 32.379335][ T45] hci_sock_ioctl+0x41e/0x7f0 [ 32.383999][ T45] sock_do_ioctl+0x101/0x310 [ 32.388581][ T45] sock_ioctl+0x4d8/0x6e0 [ 32.392908][ T45] __se_sys_ioctl+0x12f/0x1b0 [ 32.397587][ T45] __x64_sys_ioctl+0x7b/0x90 [ 32.402176][ T45] x64_sys_call+0x58b/0x9a0 [ 32.406669][ T45] do_syscall_64+0x4c/0xa0 [ 32.411081][ T45] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 32.416971][ T45] [ 32.419284][ T45] Second to last potentially related work creation: [ 32.425867][ T45] kasan_save_stack+0x3a/0x60 [ 32.430634][ T45] __kasan_record_aux_stack+0xb6/0xc0 [ 32.436019][ T45] kasan_record_aux_stack_noalloc+0xb/0x10 [ 32.441822][ T45] insert_work+0x51/0x300 [ 32.446162][ T45] __queue_work+0x9b1/0xd30 [ 32.450658][ T45] queue_work_on+0xd2/0x140 [ 32.455164][ T45] hci_cmd_timeout+0x191/0x200 [ 32.459932][ T45] process_one_work+0x71f/0xc40 [ 32.464777][ T45] worker_thread+0xa29/0x11f0 [ 32.469441][ T45] kthread+0x281/0x320 [ 32.473507][ T45] ret_from_fork+0x1f/0x30 [ 32.477927][ T45] [ 32.480260][ T45] The buggy address belongs to the object at ffff888116b90000 [ 32.480260][ T45] which belongs to the cache kmalloc-8k of size 8192 [ 32.494307][ T45] The buggy address is located 2560 bytes inside of [ 32.494307][ T45] 8192-byte region [ffff888116b90000, ffff888116b92000) [ 32.507742][ T45] [ 32.510054][ T45] The buggy address belongs to the physical page: [ 32.516476][ T45] page:ffffea00045ae400 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x116b90 [ 32.526731][ T45] head:ffffea00045ae400 order:3 compound_mapcount:0 compound_pincount:0 [ 32.535040][ T45] flags: 0x4000000000010200(slab|head|zone=1) [ 32.541113][ T45] raw: 4000000000010200 ffffea0004546c00 dead000000000005 ffff888100043500 [ 32.549706][ T45] raw: 0000000000000000 0000000080020002 00000001ffffffff 0000000000000000 [ 32.558273][ T45] page dumped because: kasan: bad access detected [ 32.564675][ T45] page_owner tracks the page as allocated [ 32.570371][ T45] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 4072305129, free_ts 0 [ 32.590251][ T45] post_alloc_hook+0x1f5/0x210 [ 32.595024][ T45] prep_new_page+0x1c/0x110 [ 32.599537][ T45] get_page_from_freelist+0x2c7b/0x2cf0 [ 32.605093][ T45] __alloc_pages+0x19e/0x3a0 [ 32.609682][ T45] alloc_slab_page+0x6e/0xf0 [ 32.614274][ T45] new_slab+0x98/0x3d0 [ 32.618349][ T45] ___slab_alloc+0x6f6/0xb50 [ 32.622942][ T45] __slab_alloc+0x5e/0xa0 [ 32.627268][ T45] __kmem_cache_alloc_node+0x203/0x2c0 [ 32.632718][ T45] kmalloc_trace+0x29/0xb0 [ 32.637128][ T45] cryptomgr_notify+0x83/0x8e0 [ 32.641995][ T45] blocking_notifier_call_chain+0xcb/0x150 [ 32.647817][ T45] crypto_alg_mod_lookup+0x3a9/0x5c0 [ 32.653114][ T45] crypto_alloc_tfm_node+0x134/0x360 [ 32.658397][ T45] crypto_alloc_akcipher+0x30/0x40 [ 32.663504][ T45] public_key_verify_signature+0x262/0xd80 [ 32.669308][ T45] page_owner free stack trace missing [ 32.674676][ T45] [ 32.676989][ T45] Memory state around the buggy address: [ 32.682607][ T45] ffff888116b90900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 32.691612][ T45] ffff888116b90980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [pid 301] ioctl(3, _IOC(_IOC_WRITE, 0x55, 0xc8, 0x4), 0) = 0 [pid 300] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 300] futex(0x7f42eb31e33c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 300] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f42eb213000 [pid 300] mprotect(0x7f42eb214000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 300] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 300] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f42eb233990, parent_tid=0x7f42eb233990, exit_signal=0, stack=0x7f42eb213000, stack_size=0x20300, tls=0x7f42eb2336c0} => {parent_tid=[10]}, 88) = 10 [pid 300] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 300] futex(0x7f42eb31e338, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 300] futex(0x7f42eb31e33c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 302 attached [pid 301] futex(0x7f42eb31e32c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 301] futex(0x7f42eb31e328, FUTEX_WAIT_PRIVATE, 0, NULL [pid 302] set_robust_list(0x7f42eb2339a0, 24) = 0 [pid 302] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [ 32.699664][ T45] >ffff888116b90a00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 32.707732][ T45] ^ [ 32.711784][ T45] ffff888116b90a80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 32.719830][ T45] ffff888116b90b00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 32.727890][ T45] ================================================================== [ 32.735933][ T45] Disabling lock debugging due to kernel taint [ 32.742428][ T8] Bluetooth: hci0: Frame reassembly failed (-84) [ 32.750609][ T28] kauditd_printk_skb: 8 callbacks suppressed [pid 302] ioctl(4, HCISETLINKPOL [pid 300] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 300] futex(0x7f42eb31e33c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=0}) = -1 ETIMEDOUT (Connection timed out) [ 32.750623][ T28] audit: type=1400 audit(1750226936.694:82): avc: denied { read } for pid=84 comm="syslogd" name="log" dev="sda1" ino=2010 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:var_t tclass=lnk_file permissive=1 [ 32.778404][ T28] audit: type=1400 audit(1750226936.694:83): avc: denied { search } for pid=84 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 32.799886][ T28] audit: type=1400 audit(1750226936.694:84): avc: denied { write } for pid=84 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 32.821117][ T28] audit: type=1400 audit(1750226936.694:85): avc: denied { add_name } for pid=84 comm="syslogd" name="messages" scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 32.841568][ T28] audit: type=1400 audit(1750226936.694:86): avc: denied { create } for pid=84 comm="syslogd" name="messages" scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 32.861930][ T28] audit: type=1400 audit(1750226936.694:87): avc: denied { append open } for pid=84 comm="syslogd" path="/tmp/messages" dev="tmpfs" ino=5 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 32.884732][ T28] audit: type=1400 audit(1750226936.694:88): avc: denied { getattr } for pid=84 comm="syslogd" path="/tmp/messages" dev="tmpfs" ino=5 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 33.933056][ T45] Bluetooth: hci0: Opcode 0x1003 failed: -110 [ 33.933063][ C0] general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] PREEMPT SMP KASAN [ 33.933086][ C0] KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] [ 33.959379][ C0] CPU: 0 PID: 0 Comm: swapper/0 Tainted: G B 6.1.138-syzkaller-00010-gba4506940166 #0 [ 33.970591][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 33.980659][ C0] RIP: 0010:__queue_work+0x575/0xd30 [ 33.985951][ C0] Code: 39 2b 0f 84 b9 00 00 00 e8 f8 d2 28 00 4c 89 ff e8 50 c6 a8 03 49 bc 00 00 00 00 00 fc ff df 4c 8b 6d d0 4c 89 e8 48 c1 e8 03 <42> 80 3c 20 00 74 08 4c 89 ef e8 0c 2b 6d 00 49 8b 7d 00 e8 33 c2 [ 34.005582][ C0] RSP: 0018:ffffc90000007c70 EFLAGS: 00010046 [ 34.011640][ C0] RAX: 0000000000000000 RBX: 000000007fffffff RCX: ffffffff86e1c500 [ 34.019599][ C0] RDX: 0000000000000100 RSI: 000000007fffffff RDI: 000000007fffffff [ 34.027561][ C0] RBP: ffffc90000007d08 R08: fffffffffffffffb R09: 0000000000000007 [ 34.035524][ C0] R10: ffffed1022d72139 R11: 1ffff11022d72139 R12: dffffc0000000000 [ 34.043515][ C0] R13: 0000000000000000 R14: ffff888116b909c8 R15: 0000000000000008 [ 34.051504][ C0] FS: 0000000000000000(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000 [ 34.060437][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 34.067023][ C0] CR2: 00007f42eb233d58 CR3: 000000011e793000 CR4: 00000000003506b0 [ 34.074995][ C0] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 34.082961][ C0] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 34.090933][ C0] Call Trace: [ 34.094207][ C0] [ 34.097053][ C0] delayed_work_timer_fn+0x61/0x80 [ 34.102171][ C0] ? __cfi_delayed_work_timer_fn+0x10/0x10 [ 34.107978][ C0] call_timer_fn+0x46/0x2a0 [ 34.112495][ C0] ? __cfi_delayed_work_timer_fn+0x10/0x10 [ 34.118328][ C0] __run_timers+0x667/0x9a0 [ 34.122860][ C0] ? calc_index+0x200/0x200 [ 34.127375][ C0] ? kvm_sched_clock_read+0x18/0x40 [ 34.132602][ C0] run_timer_softirq+0x6a/0xf0 [ 34.137386][ C0] handle_softirqs+0x1d7/0x600 [ 34.142166][ C0] ? irqtime_account_irq+0xc4/0x240 [ 34.147387][ C0] __irq_exit_rcu+0x52/0xf0 [ 34.151907][ C0] irq_exit_rcu+0x9/0x10 [ 34.156172][ C0] sysvec_apic_timer_interrupt+0xa9/0xc0 [ 34.161820][ C0] [ 34.164768][ C0] [ 34.167697][ C0] asm_sysvec_apic_timer_interrupt+0x1b/0x20 [ 34.173682][ C0] RIP: 0010:default_idle+0xf/0x20 [ 34.178711][ C0] Code: e9 47 ff ff ff 00 00 cc cc 00 00 90 90 90 90 90 90 90 90 90 90 90 b8 0c 67 40 a5 55 48 89 e5 66 90 0f 00 2d 43 79 56 00 fb f4 <5d> c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 90 90 90 90 90 [ 34.198317][ C0] RSP: 0018:ffffffff86e07d58 EFLAGS: 00000257 [ 34.204385][ C0] RAX: ffff8881f7000000 RBX: ffffffff86e1c500 RCX: 30081e1ed6e2c300 [ 34.212377][ C0] RDX: 0000000000000001 RSI: ffffffff85a9f780 RDI: ffffffff85a9f740 [ 34.220344][ C0] RBP: ffffffff86e07d58 R08: dffffc0000000000 R09: ffffed103ee06917 [ 34.228320][ C0] R10: 0000000000000000 R11: ffffffff84efba30 R12: 0000000000000000 [ 34.236294][ C0] R13: 0000000000000000 R14: ffffffff86e1c500 R15: dffffc0000000000 [ 34.244290][ C0] ? __cfi_default_idle+0x10/0x10 [ 34.249332][ C0] arch_cpu_idle+0x1c/0x20 [ 34.253750][ C0] default_idle_call+0x71/0x1d0 [ 34.258602][ C0] do_idle+0x1a7/0x520 [ 34.262675][ C0] ? idle_inject_timer_fn+0x60/0x60 [ 34.267874][ C0] ? debug_smp_processor_id+0x17/0x20 [ 34.273248][ C0] cpu_startup_entry+0x43/0x60 [ 34.278015][ C0] rest_init+0x10a/0x130 [ 34.282260][ C0] ? __cfi_x86_late_time_init+0x8/0x8 [ 34.287637][ C0] arch_call_rest_init+0xe/0x10 [ 34.292489][ C0] start_kernel+0x482/0x4f0 [ 34.297015][ C0] x86_64_start_reservations+0x2a/0x2c [ 34.302499][ C0] x86_64_start_kernel+0x7c/0x81 [ 34.307467][ C0] secondary_startup_64_no_verify+0xce/0xdb [ 34.313386][ C0] [ 34.316412][ C0] Modules linked in: [ 34.320410][ C0] ---[ end trace 0000000000000000 ]--- [ 34.326135][ C0] RIP: 0010:__queue_work+0x575/0xd30 [ 34.331427][ C0] Code: 39 2b 0f 84 b9 00 00 00 e8 f8 d2 28 00 4c 89 ff e8 50 c6 a8 03 49 bc 00 00 00 00 00 fc ff df 4c 8b 6d d0 4c 89 e8 48 c1 e8 03 <42> 80 3c 20 00 74 08 4c 89 ef e8 0c 2b 6d 00 49 8b 7d 00 e8 33 c2 [ 34.351025][ C0] RSP: 0018:ffffc90000007c70 EFLAGS: 00010046 [ 34.357105][ C0] RAX: 0000000000000000 RBX: 000000007fffffff RCX: ffffffff86e1c500 [ 34.365074][ C0] RDX: 0000000000000100 RSI: 000000007fffffff RDI: 000000007fffffff [ 34.373043][ C0] RBP: ffffc90000007d08 R08: fffffffffffffffb R09: 0000000000000007 [ 34.381011][ C0] R10: ffffed1022d72139 R11: 1ffff11022d72139 R12: dffffc0000000000 [ 34.388978][ C0] R13: 0000000000000000 R14: ffff888116b909c8 R15: 0000000000000008 [ 34.396944][ C0] FS: 0000000000000000(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000 [ 34.405883][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 34.412461][ C0] CR2: 00007f42eb233d58 CR3: 000000011e793000 CR4: 00000000003506b0 [ 34.420434][ C0] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 34.428421][ C0] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 34.436395][ C0] Kernel panic - not syncing: Fatal exception in interrupt [ 34.443889][ C0] Kernel Offset: disabled [ 34.448204][ C0] Rebooting in 86400 seconds..