Extracting prog: 1h52m50.311784538s
Minimizing prog: 11m13.398603935s
Simplifying prog options: 0s
Extracting C: 56.363960193s
Simplifying C: 20m36.532953412s


extracting reproducer from 13 programs
first checking the prog from the crash report
single: executing 1 programs separately with timeout 30s
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): getrandom-syz_init_net_socket$bt_rfcomm-connect$bt_rfcomm-getsockopt$sock_buf-capget-socket$inet6_tcp-dup-ioctl$SIOCSIFHWADDR-ioctl$TIOCMIWAIT-socket$nl_xfrm-sendmsg$nl_xfrm-openat-socket$inet6-setsockopt$inet6_int-bind$inet6-recvmmsg-sendto$inet6-socket$inet_tcp-setsockopt$inet_tcp_int-setsockopt$inet_tcp_TCP_REPAIR_QUEUE-getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE-fcntl$setlease-fcntl$getflags-ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_CLIENT-socket$inet6_tcp-syz_open_dev$ttys-ioctl$GIO_CMAP-syz_usb_connect-ioctl$TIOCGPTLCK-getsockopt$inet6_tcp_buf
detailed listing:
executing program 0:
getrandom(&(0x7f0000000240)=""/286, 0xffffff9a, 0x0)
r0 = syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3)
connect$bt_rfcomm(r0, &(0x7f00000003c0)={0x1f, @none, 0x8}, 0xa)
getsockopt$sock_buf(r0, 0x1, 0x1c, 0x0, &(0x7f0000004c00))
capget(&(0x7f00000000c0)={0x19980330}, &(0x7f0000000100)={0x4, 0xfffffff7, 0x4, 0x8, 0x6, 0xffff})
r1 = socket$inet6_tcp(0xa, 0x1, 0x0)
r2 = dup(r1)
ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x9af139be227d9862}})
ioctl$TIOCMIWAIT(r2, 0x545c, 0x0)
r3 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000000)=ANY=[@ANYBLOB="500100001a00330600000000fddbdf25fe8000000000000000000000000000aafe8000000000000000000000000000aa000040002c6c80050000800000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="fe8000000000000000000000000000bb000000003200000000000000000000000000000000000001230300000000000001000080000000000000000000000000c0000000000000000040000000000000000000000000000000000000000000000800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000029bd7000033500000a000500000000000000000048000200656362286369706865725f6e756c6c290000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000005002100020000000800280000000000080027"], 0x150}, 0x1, 0x0, 0x0, 0x4000}, 0x200080d4)
r4 = openat(0xffffffffffffffff, &(0x7f00000000c0)='./file1\x00', 0x281c2, 0x0)
r5 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$inet6_int(r5, 0x29, 0x35, &(0x7f0000000000)=0x7907, 0x4)
bind$inet6(r5, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x7ff, @empty, 0x9}, 0x1c)
recvmmsg(r5, &(0x7f0000000240)=[{{0x0, 0x0, 0x0}, 0x8}], 0x1, 0x2, 0x0)
sendto$inet6(r2, 0x0, 0x0, 0x20004184, &(0x7f0000000200)={0xa, 0x4e20, 0x0, @local}, 0x1c)
r6 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$inet_tcp_int(r6, 0x6, 0x210000000013, &(0x7f0000000040)=0x100000001, 0x4)
setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r4, 0x6, 0x14, &(0x7f0000000140)=0x2, 0x4)
getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r6, 0x6, 0x15, 0x0, &(0x7f0000001880))
fcntl$setlease(r4, 0x400, 0x1)
fcntl$getflags(r4, 0x401)
ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_CLIENT(r4, 0xc04c5349, &(0x7f0000000040)={0x1, 0xfc, 0x8})
r7 = socket$inet6_tcp(0xa, 0x1, 0x0)
r8 = syz_open_dev$ttys(0xc, 0x2, 0x0)
ioctl$GIO_CMAP(r8, 0x4b70, &(0x7f0000000000))
syz_usb_connect(0x0, 0x24, &(0x7f00000001c0)=ANY=[@ANYBLOB="12010000b5b30a40450c056055b5010203010902120001000000000904", @ANYRES64=r7], 0x0)
ioctl$TIOCGPTLCK(r8, 0x5420, &(0x7f0000001d40))
getsockopt$inet6_tcp_buf(r7, 0x6, 0x1a, 0x0, &(0x7f00000003c0))

program did not crash
single: failed to extract reproducer
bisect: bisecting 13 programs with base timeout 30s
testing program (duration=33s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [6, 15, 8, 17, 29, 6, 8, 12, 30, 5, 14, 2, 9]
detailed listing:
executing program 0:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x1f)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000000)={0x5, 0x1, 0x40000, 0x2000, &(0x7f0000fe5000/0x2000)=nil})
ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f0000000200)={0x1, 0x0, [{0x4b564d01, 0x0, 0x1}]})
mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x300000a, 0x4031, 0xffffffffffffffff, 0x0)
executing program 0:
r0 = syz_open_dev$tty1(0xc, 0x4, 0x1)
r1 = fsopen(&(0x7f0000000000)='ext3\x00', 0x0)
r2 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPCTNL_MSG_EXP_DELETE(r2, &(0x7f0000000140)={0x0, 0x14, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="50000000020a010400000000000000000a0000003c0002800c00028005000100000000002c00018014000300fe8000000000000000000000000000001400040000000000000000000000000000000001"], 0x50}}, 0x0)
fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f0000000100)='test_dummy_encryption', &(0x7f0000000240)='v2\x00ul\x00\x00\x00\x00\x00loc\x8d\x8b#\xe0\xb9\xbd\"\xeb.\xc7]\xa67\x97 \xc9\xfc|\x85o7Z\xdc}U\x8c\xdd\n\xaa?4\xafq\x1d\xf6(\xe6\x9em_\x1a\xbfDi\x15\x81\xd47\x8e\x86\xa2u~FC\x9c\xe3\x98\x87\x98\xf7\xa2\xb5\x12\x8cv\xe4_\x91\xa8G!mm\f\xcf\xfb[\xd5Qf\x15\xfe\xc80\xad\xaa\xe9', 0x0)
fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f0000000040)='test_dummy_encryption', &(0x7f0000000180)='v1\x00ul\x00\x00\x00\x00\x00loc\x8d\x8b#\xe0\xb9\xbd\"\xeb.\xc7]\xa67\x97 \xc9\xfc|\x85o7Z\xdc}U\x8c\xdd\n\xaa?4\xafq\x1d\xf6(\xe6\x9em_\x1a\xbfDi\x15\x81\xd47\x8e\x86\xa2u~FC\x9c\xe3\x98\x87\x98\xf7\xa2\xb5\x12\x8cv\xe4_\x91\xa8G!mm\f\xcf\xfb[\xd5Qf\x15\xfe\xc80\xad\xaa\xe9', 0x0)
socket$nl_generic(0x10, 0x3, 0x10)
r3 = socket$inet_udp(0x2, 0x2, 0x0)
setsockopt$SO_TIMESTAMPING(r3, 0x1, 0x25, &(0x7f0000000200)=0x474c, 0x4)
bind$inet(r3, &(0x7f0000000240)={0x2, 0x0, @local}, 0x6f)
connect$inet(r3, &(0x7f0000000480)={0x2, 0x0, @multicast1}, 0x10)
sendmmsg(r3, &(0x7f0000007fc0), 0x800001d, 0x300)
setsockopt$inet_int(r3, 0x0, 0xb, 0x0, 0x0)
ioctl$TIOCL_SETSEL(r0, 0x560f, &(0x7f00000000c0)={0x2, {0x2, 0x0, 0x300, 0x0, 0x8, 0x300}})
ioctl$FIONREAD(r0, 0x541b, &(0x7f00000002c0))
executing program 1:
syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0), 0xffffffffffffffff)
openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x200, 0x0)
ioctl$KVM_CREATE_IRQCHIP(0xffffffffffffffff, 0xae60)
ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil})
r0 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0)
ioctl$KVM_RUN(r0, 0xae80, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION2(0xffffffffffffffff, 0x40a0ae49, &(0x7f00000005c0)={0x101ff, 0x0, 0xe000, 0x2000, &(0x7f0000000000/0x2000)=nil, 0x7ff})
ioctl$KVM_RUN(r0, 0xae80, 0x0)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./dev\x00', 0x1ff)
sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001380)={0x0, 0x0, &(0x7f0000001340)={&(0x7f0000000000)=ANY=[@ANYBLOB="f4"], 0x6f4}}, 0x0)
mount(0x0, &(0x7f0000001500)='./dev\x00', &(0x7f0000001600)='devtmpfs\x00', 0x0, 0x0)
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$wireguard(&(0x7f00000003c0), 0xffffffffffffffff)
r2 = socket$packet(0x11, 0x2, 0x300)
r3 = socket$nl_generic(0x10, 0x3, 0x10)
r4 = syz_genetlink_get_family_id$devlink(&(0x7f00000000c0), 0xffffffffffffffff)
sendmsg$DEVLINK_CMD_PORT_GET(r3, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f00000004c0)={0x3c, r4, 0x1, 0x70bd2b, 0x0, {0x35}, [{{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x73, 0x2}}}]}, 0x3c}}, 0x0)
ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000040)={'ip6tnl0\x00'})
sendmsg$WG_CMD_SET_DEVICE(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x14, r1, 0x1, 0x78bd29, 0xfffffffe}, 0x14}, 0x1, 0x0, 0x0, 0x4044885}, 0x4c0c0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./mnt\x00', 0x1a7)
mount(&(0x7f00000000c0)=@filename='./dev/sda1\x00', &(0x7f0000000140)='./mnt\x00', &(0x7f0000000100)='ext4\x00', 0x8410, 0x0)
mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1)
sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0)
chdir(&(0x7f0000000140)='./file0\x00')
mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz1\x00', 0x1ff)
executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) (async)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x1)
r3 = socket$netlink(0x10, 0x3, 0x0)
setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(r3, 0x10e, 0xc, &(0x7f0000000640)=0x7, 0x4) (async)
setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(r3, 0x10e, 0xc, &(0x7f0000000640)=0x7, 0x4)
sendmsg$netlink(r3, &(0x7f0000001080)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000300)={0x2c, 0x12, 0x1, 0x70bd26, 0x25dfdbfe, "", [@nested={0x10, 0x0, 0x0, 0x0, [@typed={0xc, 0xce, 0x0, 0x0, @u64}]}, @nested={0xc, 0x35, 0x0, 0x1, [@typed={0x8, 0x68, 0x0, 0x0, @u32=0x2da6}]}]}, 0x2c}], 0x1, 0x0, 0x0, 0x4000}, 0x4000800) (async)
sendmsg$netlink(r3, &(0x7f0000001080)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000300)={0x2c, 0x12, 0x1, 0x70bd26, 0x25dfdbfe, "", [@nested={0x10, 0x0, 0x0, 0x0, [@typed={0xc, 0xce, 0x0, 0x0, @u64}]}, @nested={0xc, 0x35, 0x0, 0x1, [@typed={0x8, 0x68, 0x0, 0x0, @u32=0x2da6}]}]}, 0x2c}], 0x1, 0x0, 0x0, 0x4000}, 0x4000800)
r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x1e9100, 0x0)
r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0)
syz_emit_vhci(&(0x7f0000001a40)=@HCI_EVENT_PKT={0x4, @hci_ev_auth_complete={{0x6, 0x3}, {0x0, 0xc9}}}, 0x6)
ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x2) (async)
r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x2)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r6, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000180)=[@text64={0x40, 0x0}], 0x1, 0x54, 0x0, 0x0) (async)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r6, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000180)=[@text64={0x40, 0x0}], 0x1, 0x54, 0x0, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000014000/0x18000)=nil, &(0x7f0000000100)=[@text64={0x40, 0x0}], 0x1, 0x4a, 0x0, 0x0)
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000100)={{0x14}, [@NFT_MSG_NEWTABLE={0x14, 0x0, 0xa, 0x101, 0x0, 0x0, {0x2}}], {0x14}}, 0x3c}}, 0x0)
syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@textreal={0x8, 0x0}], 0x1, 0x7a, 0x0, 0x0)
setns(0xc9, 0x0)
r7 = socket$nl_generic(0x10, 0x3, 0x10)
r8 = socket$nl_netfilter(0x10, 0x3, 0xc)
syz_genetlink_get_family_id$nl80211(&(0x7f0000000340), r7) (async)
r9 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000340), r7)
ioctl$sock_SIOCGIFINDEX_80211(r8, 0x8933, &(0x7f0000000380)={'wlan1\x00'}) (async)
ioctl$sock_SIOCGIFINDEX_80211(r8, 0x8933, &(0x7f0000000380)={'wlan1\x00', <r10=>0x0})
sendmsg$NL80211_CMD_DISCONNECT(r7, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000400)={&(0x7f00000003c0)={0x1c, r9, 0x1, 0x70bd2d, 0x25dfdbfb, {{}, {@val={0x8, 0x3, r10}, @void}}}, 0x1c}, 0x1, 0x0, 0x0, 0x8090}, 0x8814)
socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040))
ioctl$KVM_RUN(r2, 0xae80, 0x0)
executing program 2:
r0 = socket$inet_mptcp(0x2, 0x1, 0x106)
connect$inet(r0, &(0x7f0000000380)={0x2, 0x4e20, @local}, 0x10)
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={0x0}}, 0x4008800) (async)
getsockopt$inet_mptcp_buf(r0, 0x11c, 0x4, &(0x7f00000000c0)=""/191, &(0x7f0000000080)=0xbf) (async)
openat$mice(0xffffffffffffff9c, &(0x7f0000001200), 0x80000) (async)
openat$mice(0xffffffffffffff9c, &(0x7f0000001400), 0x105000)
executing program 3:
r0 = socket$nl_netfilter(0x10, 0x3, 0xc) (async)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)={0x48, 0x42, 0x1, 0x0, 0x0, {0x3, 0x1}, [@generic="0f000000", @typed={0x26, 0x1, 0x0, 0x0, @binary="d0d4c292c54d4e968899aabb08004500001c00000000010100000101010102020202"}, @nested={0x4, 0x8002}, @nested={0x4, 0x8003}]}, 0x48}, 0x1, 0x0, 0x0, 0x4004000}, 0x0) (async)
syz_genetlink_get_family_id$tipc2(&(0x7f0000000040), r1)
r2 = fsopen(&(0x7f00000000c0)='ubifs\x00', 0x1)
fsconfig$FSCONFIG_SET_STRING(r2, 0x1, &(0x7f0000000000)='source', &(0x7f0000000040), 0x0)
fsconfig$FSCONFIG_CMD_CREATE(r2, 0x6, 0x0, 0x0, 0x0) (async, rerun: 32)
sendmsg$IPCTNL_MSG_EXP_GET(r0, &(0x7f0000006680)={0x0, 0x0, &(0x7f0000006640)={&(0x7f0000000240)=ANY=[@ANYBLOB="580000000102010100000000000000000a0000013c0001802c00018014000300ff01000000000000000000000000000114000400000000000000000000000000000000010c0002800500010095000004060007"], 0x58}, 0x1, 0x0, 0x0, 0xc0}, 0x8d0) (rerun: 32)
executing program 3:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$ethtool(&(0x7f00000002c0), r0)
r2 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IP_VS_SO_SET_ADD(r2, 0x0, 0x482, &(0x7f00000008c0)={0x84, @rand_addr=0x64010102, 0x4e22, 0x1, 'none\x00', 0x0, 0x10002, 0x6f}, 0x2c)
setsockopt$IP_VS_SO_SET_DEL(r2, 0x0, 0x483, &(0x7f0000001280)={0x20000000000084, @private=0xa010102, 0x4e24, 0x200000001, 'wrr\x00', 0x9, 0x821}, 0x2c)
sendmsg$ETHTOOL_MSG_LINKMODES_SET(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000080)=ANY=[@ANYBLOB="14000000", @ANYRES16=r1, @ANYBLOB="090300000000000000002e"], 0x14}}, 0x0)
socket$nl_generic(0x10, 0x3, 0x10) (async)
syz_genetlink_get_family_id$ethtool(&(0x7f00000002c0), r0) (async)
socket$inet_icmp_raw(0x2, 0x3, 0x1) (async)
setsockopt$IP_VS_SO_SET_ADD(r2, 0x0, 0x482, &(0x7f00000008c0)={0x84, @rand_addr=0x64010102, 0x4e22, 0x1, 'none\x00', 0x0, 0x10002, 0x6f}, 0x2c) (async)
setsockopt$IP_VS_SO_SET_DEL(r2, 0x0, 0x483, &(0x7f0000001280)={0x20000000000084, @private=0xa010102, 0x4e24, 0x200000001, 'wrr\x00', 0x9, 0x821}, 0x2c) (async)
sendmsg$ETHTOOL_MSG_LINKMODES_SET(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000080)=ANY=[@ANYBLOB="14000000", @ANYRES16=r1, @ANYBLOB="090300000000000000002e"], 0x14}}, 0x0) (async)
executing program 2:
getrandom(&(0x7f0000000240)=""/286, 0xffffff9a, 0x0)
r0 = syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3)
connect$bt_rfcomm(r0, &(0x7f00000003c0)={0x1f, @none, 0x8}, 0xa)
getsockopt$sock_buf(r0, 0x1, 0x1c, 0x0, &(0x7f0000004c00))
capget(&(0x7f00000000c0)={0x19980330}, &(0x7f0000000100)={0x4, 0xfffffff7, 0x4, 0x8, 0x6, 0xffff})
r1 = socket$inet6_tcp(0xa, 0x1, 0x0)
r2 = dup(r1)
ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x9af139be227d9862}})
ioctl$TIOCMIWAIT(r2, 0x545c, 0x0)
r3 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000000)=ANY=[@ANYBLOB="500100001a00330600000000fddbdf25fe8000000000000000000000000000aafe8000000000000000000000000000aa000040002c6c80050000800000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="fe8000000000000000000000000000bb000000003200000000000000000000000000000000000001230300000000000001000080000000000000000000000000c0000000000000000040000000000000000000000000000000000000000000000800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000029bd7000033500000a000500000000000000000048000200656362286369706865725f6e756c6c290000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000005002100020000000800280000000000080027"], 0x150}, 0x1, 0x0, 0x0, 0x4000}, 0x200080d4)
r4 = openat(0xffffffffffffffff, &(0x7f00000000c0)='./file1\x00', 0x281c2, 0x0)
r5 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$inet6_int(r5, 0x29, 0x35, &(0x7f0000000000)=0x7907, 0x4)
bind$inet6(r5, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x7ff, @empty, 0x9}, 0x1c)
recvmmsg(r5, &(0x7f0000000240)=[{{0x0, 0x0, 0x0}, 0x8}], 0x1, 0x2, 0x0)
sendto$inet6(r2, 0x0, 0x0, 0x20004184, &(0x7f0000000200)={0xa, 0x4e20, 0x0, @local}, 0x1c)
r6 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$inet_tcp_int(r6, 0x6, 0x210000000013, &(0x7f0000000040)=0x100000001, 0x4)
setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r4, 0x6, 0x14, &(0x7f0000000140)=0x2, 0x4)
getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r6, 0x6, 0x15, 0x0, &(0x7f0000001880))
fcntl$setlease(r4, 0x400, 0x1)
fcntl$getflags(r4, 0x401)
ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_CLIENT(r4, 0xc04c5349, &(0x7f0000000040)={0x1, 0xfc, 0x8})
r7 = socket$inet6_tcp(0xa, 0x1, 0x0)
r8 = syz_open_dev$ttys(0xc, 0x2, 0x0)
ioctl$GIO_CMAP(r8, 0x4b70, &(0x7f0000000000))
syz_usb_connect(0x0, 0x24, &(0x7f00000001c0)=ANY=[@ANYBLOB="12010000b5b30a40450c056055b5010203010902120001000000000904", @ANYRES64=r7], 0x0)
ioctl$TIOCGPTLCK(r8, 0x5420, &(0x7f0000001d40))
getsockopt$inet6_tcp_buf(r7, 0x6, 0x1a, 0x0, &(0x7f00000003c0))
executing program 3:
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x44040}, 0x4000000)
socket$nl_netfilter(0x10, 0x3, 0xc)
socketpair$nbd(0x1, 0x1, 0x0, 0x0)
ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8923, &(0x7f0000000040)={'wlan1\x00', @random="2e2ee363a4b1"})
executing program 0:
r0 = syz_open_dev$sndctrl(&(0x7f0000001440), 0x0, 0x0)
ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(r0, 0x40045532, &(0x7f0000000100))
r1 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0), 0x88602, 0x0)
ioctl$SNDCTL_DSP_GETODELAY(r1, 0x80045017, 0x0)
r2 = syz_open_dev$sndpcmp(&(0x7f00000001c0), 0x0, 0xa2c65)
r3 = syz_usb_connect(0x0, 0x3f, &(0x7f00000000c0)=ANY=[@ANYBLOB="11010000733336088dee1adb23610000000109022d0001100000000904000003fe03010009cd8d1f000200000009050502000000001009058b1e20"], 0x0)
sendmsg$nl_route_sched_retired(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000ac0)=@newtclass={0x24, 0x28, 0x8, 0x70bd2a, 0x25dfdbfc, {0x0, 0x0, 0x0, 0x0, {0x7, 0x8}, {0xfff3, 0xf}, {0x4, 0xfff1}}}, 0x24}, 0x1, 0x0, 0x0, 0x81c1}, 0x9080)
syz_usb_control_io$printer(r3, 0x0, &(0x7f0000000800)={0x34, &(0x7f0000000500)={0x20, 0x13}, 0x0, 0x0, 0x0, 0x0, 0x0})
r4 = syz_open_dev$char_usb(0xc, 0xb4, 0x0)
ioctl$FS_IOC_GETVERSION(r4, 0xc0145b0e, &(0x7f0000000040))
pselect6(0x40, &(0x7f0000000100)={0x2, 0xfffffffffffffffe, 0x2, 0x64000000, 0x1, 0x0, 0xffffff7ffffffffd}, 0x0, &(0x7f0000000240)={0x1f, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x6}, &(0x7f0000000280)={0x0, 0x3938700}, 0x0)
ioctl$SNDRV_PCM_IOCTL_SW_PARAMS(r2, 0x4112, 0x0)
ioctl$SNDCTL_DSP_GETOPTR(r1, 0x800c5012, &(0x7f0000000200))
syz_usb_connect$uac1(0x3, 0x72, &(0x7f0000000480)={{0x12, 0x1, 0x201, 0x0, 0x0, 0x0, 0x8, 0x2b73, 0x1b, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x60, 0x3, 0x1, 0xc, 0x20, 0x0, "", {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, {{0xa, 0x24, 0x1, 0x3, 0xa}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x10, 0x8, 0x6, 0x9, {0x7, 0x25, 0x1, 0x8, 0x9, 0x8}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x8, 0x4, 0x7, 0x7, {0x7, 0x25, 0x1, 0xc, 0x4, 0x9}}}}}}}}]}}, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x1, [{0x55, &(0x7f0000000040)=@string={0x55, 0x3, "e10280f5c41ad0517e7ec5227719b6e3815873c33805db7de9f9bc78b91178319e7eab78aca5938d14eedeb4a3f09135eedd3595144401eba0487d8c4a0d1e9769dd350152d50e2e3c1760096608fda07cbe7a"}}]})
executing program 3:
r0 = syz_open_dev$vim2m(&(0x7f0000000000), 0x800, 0x2)
ioctl$VIDIOC_G_SELECTION(r0, 0xc040565e, &(0x7f0000000180)={0x2, 0x1000000, 0x0, {0x4, 0x23, 0x0, 0x6}})
executing program 3:
r0 = socket$inet6(0xa, 0x3, 0x5)
connect$inet6(r0, &(0x7f0000000100)={0xa, 0x4e21, 0x5, @loopback, 0x3ff}, 0x1c)
sendmmsg(r0, &(0x7f0000001500)=[{{&(0x7f0000000180)=@l2tp6={0xa, 0x500, 0x80000, @remote, 0x0, 0x3}, 0x80, 0x0}, 0x5b4}], 0x1, 0xc040)
r1 = socket$packet(0x11, 0x3, 0x300)
getsockopt$packet_buf(r1, 0x107, 0x18, 0x0, &(0x7f0000000380))
syz_open_dev$vim2m(&(0x7f0000000000), 0x7ff, 0x2)
r2 = syz_open_dev$swradio(&(0x7f00000000c0), 0x0, 0x2)
ioctl$VIDIOC_G_SELECTION(r2, 0xc040565e, &(0x7f0000000140)={0x2, 0x1, 0x4, {0x3, 0x26, 0x40, 0x6}})
ioctl$NILFS_IOCTL_CHANGE_CPMODE(0xffffffffffffffff, 0x40106e80, &(0x7f0000000040)={0x6, 0x1})

program did not crash
replaying the whole log did not cause a kernel crash
single: executing 1 programs separately with timeout 1m40s
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): getrandom-syz_init_net_socket$bt_rfcomm-connect$bt_rfcomm-getsockopt$sock_buf-capget-socket$inet6_tcp-dup-ioctl$SIOCSIFHWADDR-ioctl$TIOCMIWAIT-socket$nl_xfrm-sendmsg$nl_xfrm-openat-socket$inet6-setsockopt$inet6_int-bind$inet6-recvmmsg-sendto$inet6-socket$inet_tcp-setsockopt$inet_tcp_int-setsockopt$inet_tcp_TCP_REPAIR_QUEUE-getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE-fcntl$setlease-fcntl$getflags-ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_CLIENT-socket$inet6_tcp-syz_open_dev$ttys-ioctl$GIO_CMAP-syz_usb_connect-ioctl$TIOCGPTLCK-getsockopt$inet6_tcp_buf
detailed listing:
executing program 0:
getrandom(&(0x7f0000000240)=""/286, 0xffffff9a, 0x0)
r0 = syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3)
connect$bt_rfcomm(r0, &(0x7f00000003c0)={0x1f, @none, 0x8}, 0xa)
getsockopt$sock_buf(r0, 0x1, 0x1c, 0x0, &(0x7f0000004c00))
capget(&(0x7f00000000c0)={0x19980330}, &(0x7f0000000100)={0x4, 0xfffffff7, 0x4, 0x8, 0x6, 0xffff})
r1 = socket$inet6_tcp(0xa, 0x1, 0x0)
r2 = dup(r1)
ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x9af139be227d9862}})
ioctl$TIOCMIWAIT(r2, 0x545c, 0x0)
r3 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000000)=ANY=[@ANYBLOB="500100001a00330600000000fddbdf25fe8000000000000000000000000000aafe8000000000000000000000000000aa000040002c6c80050000800000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="fe8000000000000000000000000000bb000000003200000000000000000000000000000000000001230300000000000001000080000000000000000000000000c0000000000000000040000000000000000000000000000000000000000000000800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000029bd7000033500000a000500000000000000000048000200656362286369706865725f6e756c6c290000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000005002100020000000800280000000000080027"], 0x150}, 0x1, 0x0, 0x0, 0x4000}, 0x200080d4)
r4 = openat(0xffffffffffffffff, &(0x7f00000000c0)='./file1\x00', 0x281c2, 0x0)
r5 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$inet6_int(r5, 0x29, 0x35, &(0x7f0000000000)=0x7907, 0x4)
bind$inet6(r5, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x7ff, @empty, 0x9}, 0x1c)
recvmmsg(r5, &(0x7f0000000240)=[{{0x0, 0x0, 0x0}, 0x8}], 0x1, 0x2, 0x0)
sendto$inet6(r2, 0x0, 0x0, 0x20004184, &(0x7f0000000200)={0xa, 0x4e20, 0x0, @local}, 0x1c)
r6 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$inet_tcp_int(r6, 0x6, 0x210000000013, &(0x7f0000000040)=0x100000001, 0x4)
setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r4, 0x6, 0x14, &(0x7f0000000140)=0x2, 0x4)
getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r6, 0x6, 0x15, 0x0, &(0x7f0000001880))
fcntl$setlease(r4, 0x400, 0x1)
fcntl$getflags(r4, 0x401)
ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_CLIENT(r4, 0xc04c5349, &(0x7f0000000040)={0x1, 0xfc, 0x8})
r7 = socket$inet6_tcp(0xa, 0x1, 0x0)
r8 = syz_open_dev$ttys(0xc, 0x2, 0x0)
ioctl$GIO_CMAP(r8, 0x4b70, &(0x7f0000000000))
syz_usb_connect(0x0, 0x24, &(0x7f00000001c0)=ANY=[@ANYBLOB="12010000b5b30a40450c056055b5010203010902120001000000000904", @ANYRES64=r7], 0x0)
ioctl$TIOCGPTLCK(r8, 0x5420, &(0x7f0000001d40))
getsockopt$inet6_tcp_buf(r7, 0x6, 0x1a, 0x0, &(0x7f00000003c0))

program did not crash
single: failed to extract reproducer
bisect: bisecting 13 programs with base timeout 1m40s
testing program (duration=1m43s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [6, 15, 8, 17, 29, 6, 8, 12, 30, 5, 14, 2, 9]
detailed listing:
executing program 0:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x1f)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000000)={0x5, 0x1, 0x40000, 0x2000, &(0x7f0000fe5000/0x2000)=nil})
ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f0000000200)={0x1, 0x0, [{0x4b564d01, 0x0, 0x1}]})
mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x300000a, 0x4031, 0xffffffffffffffff, 0x0)
executing program 0:
r0 = syz_open_dev$tty1(0xc, 0x4, 0x1)
r1 = fsopen(&(0x7f0000000000)='ext3\x00', 0x0)
r2 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPCTNL_MSG_EXP_DELETE(r2, &(0x7f0000000140)={0x0, 0x14, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="50000000020a010400000000000000000a0000003c0002800c00028005000100000000002c00018014000300fe8000000000000000000000000000001400040000000000000000000000000000000001"], 0x50}}, 0x0)
fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f0000000100)='test_dummy_encryption', &(0x7f0000000240)='v2\x00ul\x00\x00\x00\x00\x00loc\x8d\x8b#\xe0\xb9\xbd\"\xeb.\xc7]\xa67\x97 \xc9\xfc|\x85o7Z\xdc}U\x8c\xdd\n\xaa?4\xafq\x1d\xf6(\xe6\x9em_\x1a\xbfDi\x15\x81\xd47\x8e\x86\xa2u~FC\x9c\xe3\x98\x87\x98\xf7\xa2\xb5\x12\x8cv\xe4_\x91\xa8G!mm\f\xcf\xfb[\xd5Qf\x15\xfe\xc80\xad\xaa\xe9', 0x0)
fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f0000000040)='test_dummy_encryption', &(0x7f0000000180)='v1\x00ul\x00\x00\x00\x00\x00loc\x8d\x8b#\xe0\xb9\xbd\"\xeb.\xc7]\xa67\x97 \xc9\xfc|\x85o7Z\xdc}U\x8c\xdd\n\xaa?4\xafq\x1d\xf6(\xe6\x9em_\x1a\xbfDi\x15\x81\xd47\x8e\x86\xa2u~FC\x9c\xe3\x98\x87\x98\xf7\xa2\xb5\x12\x8cv\xe4_\x91\xa8G!mm\f\xcf\xfb[\xd5Qf\x15\xfe\xc80\xad\xaa\xe9', 0x0)
socket$nl_generic(0x10, 0x3, 0x10)
r3 = socket$inet_udp(0x2, 0x2, 0x0)
setsockopt$SO_TIMESTAMPING(r3, 0x1, 0x25, &(0x7f0000000200)=0x474c, 0x4)
bind$inet(r3, &(0x7f0000000240)={0x2, 0x0, @local}, 0x6f)
connect$inet(r3, &(0x7f0000000480)={0x2, 0x0, @multicast1}, 0x10)
sendmmsg(r3, &(0x7f0000007fc0), 0x800001d, 0x300)
setsockopt$inet_int(r3, 0x0, 0xb, 0x0, 0x0)
ioctl$TIOCL_SETSEL(r0, 0x560f, &(0x7f00000000c0)={0x2, {0x2, 0x0, 0x300, 0x0, 0x8, 0x300}})
ioctl$FIONREAD(r0, 0x541b, &(0x7f00000002c0))
executing program 1:
syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0), 0xffffffffffffffff)
openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x200, 0x0)
ioctl$KVM_CREATE_IRQCHIP(0xffffffffffffffff, 0xae60)
ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil})
r0 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0)
ioctl$KVM_RUN(r0, 0xae80, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION2(0xffffffffffffffff, 0x40a0ae49, &(0x7f00000005c0)={0x101ff, 0x0, 0xe000, 0x2000, &(0x7f0000000000/0x2000)=nil, 0x7ff})
ioctl$KVM_RUN(r0, 0xae80, 0x0)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./dev\x00', 0x1ff)
sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001380)={0x0, 0x0, &(0x7f0000001340)={&(0x7f0000000000)=ANY=[@ANYBLOB="f4"], 0x6f4}}, 0x0)
mount(0x0, &(0x7f0000001500)='./dev\x00', &(0x7f0000001600)='devtmpfs\x00', 0x0, 0x0)
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$wireguard(&(0x7f00000003c0), 0xffffffffffffffff)
r2 = socket$packet(0x11, 0x2, 0x300)
r3 = socket$nl_generic(0x10, 0x3, 0x10)
r4 = syz_genetlink_get_family_id$devlink(&(0x7f00000000c0), 0xffffffffffffffff)
sendmsg$DEVLINK_CMD_PORT_GET(r3, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f00000004c0)={0x3c, r4, 0x1, 0x70bd2b, 0x0, {0x35}, [{{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x73, 0x2}}}]}, 0x3c}}, 0x0)
ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000040)={'ip6tnl0\x00'})
sendmsg$WG_CMD_SET_DEVICE(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x14, r1, 0x1, 0x78bd29, 0xfffffffe}, 0x14}, 0x1, 0x0, 0x0, 0x4044885}, 0x4c0c0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./mnt\x00', 0x1a7)
mount(&(0x7f00000000c0)=@filename='./dev/sda1\x00', &(0x7f0000000140)='./mnt\x00', &(0x7f0000000100)='ext4\x00', 0x8410, 0x0)
mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1)
sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0)
chdir(&(0x7f0000000140)='./file0\x00')
mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz1\x00', 0x1ff)
executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) (async)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x1)
r3 = socket$netlink(0x10, 0x3, 0x0)
setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(r3, 0x10e, 0xc, &(0x7f0000000640)=0x7, 0x4) (async)
setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(r3, 0x10e, 0xc, &(0x7f0000000640)=0x7, 0x4)
sendmsg$netlink(r3, &(0x7f0000001080)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000300)={0x2c, 0x12, 0x1, 0x70bd26, 0x25dfdbfe, "", [@nested={0x10, 0x0, 0x0, 0x0, [@typed={0xc, 0xce, 0x0, 0x0, @u64}]}, @nested={0xc, 0x35, 0x0, 0x1, [@typed={0x8, 0x68, 0x0, 0x0, @u32=0x2da6}]}]}, 0x2c}], 0x1, 0x0, 0x0, 0x4000}, 0x4000800) (async)
sendmsg$netlink(r3, &(0x7f0000001080)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000300)={0x2c, 0x12, 0x1, 0x70bd26, 0x25dfdbfe, "", [@nested={0x10, 0x0, 0x0, 0x0, [@typed={0xc, 0xce, 0x0, 0x0, @u64}]}, @nested={0xc, 0x35, 0x0, 0x1, [@typed={0x8, 0x68, 0x0, 0x0, @u32=0x2da6}]}]}, 0x2c}], 0x1, 0x0, 0x0, 0x4000}, 0x4000800)
r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x1e9100, 0x0)
r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0)
syz_emit_vhci(&(0x7f0000001a40)=@HCI_EVENT_PKT={0x4, @hci_ev_auth_complete={{0x6, 0x3}, {0x0, 0xc9}}}, 0x6)
ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x2) (async)
r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x2)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r6, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000180)=[@text64={0x40, 0x0}], 0x1, 0x54, 0x0, 0x0) (async)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r6, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000180)=[@text64={0x40, 0x0}], 0x1, 0x54, 0x0, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000014000/0x18000)=nil, &(0x7f0000000100)=[@text64={0x40, 0x0}], 0x1, 0x4a, 0x0, 0x0)
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000100)={{0x14}, [@NFT_MSG_NEWTABLE={0x14, 0x0, 0xa, 0x101, 0x0, 0x0, {0x2}}], {0x14}}, 0x3c}}, 0x0)
syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@textreal={0x8, 0x0}], 0x1, 0x7a, 0x0, 0x0)
setns(0xc9, 0x0)
r7 = socket$nl_generic(0x10, 0x3, 0x10)
r8 = socket$nl_netfilter(0x10, 0x3, 0xc)
syz_genetlink_get_family_id$nl80211(&(0x7f0000000340), r7) (async)
r9 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000340), r7)
ioctl$sock_SIOCGIFINDEX_80211(r8, 0x8933, &(0x7f0000000380)={'wlan1\x00'}) (async)
ioctl$sock_SIOCGIFINDEX_80211(r8, 0x8933, &(0x7f0000000380)={'wlan1\x00', <r10=>0x0})
sendmsg$NL80211_CMD_DISCONNECT(r7, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000400)={&(0x7f00000003c0)={0x1c, r9, 0x1, 0x70bd2d, 0x25dfdbfb, {{}, {@val={0x8, 0x3, r10}, @void}}}, 0x1c}, 0x1, 0x0, 0x0, 0x8090}, 0x8814)
socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040))
ioctl$KVM_RUN(r2, 0xae80, 0x0)
executing program 2:
r0 = socket$inet_mptcp(0x2, 0x1, 0x106)
connect$inet(r0, &(0x7f0000000380)={0x2, 0x4e20, @local}, 0x10)
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={0x0}}, 0x4008800) (async)
getsockopt$inet_mptcp_buf(r0, 0x11c, 0x4, &(0x7f00000000c0)=""/191, &(0x7f0000000080)=0xbf) (async)
openat$mice(0xffffffffffffff9c, &(0x7f0000001200), 0x80000) (async)
openat$mice(0xffffffffffffff9c, &(0x7f0000001400), 0x105000)
executing program 3:
r0 = socket$nl_netfilter(0x10, 0x3, 0xc) (async)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)={0x48, 0x42, 0x1, 0x0, 0x0, {0x3, 0x1}, [@generic="0f000000", @typed={0x26, 0x1, 0x0, 0x0, @binary="d0d4c292c54d4e968899aabb08004500001c00000000010100000101010102020202"}, @nested={0x4, 0x8002}, @nested={0x4, 0x8003}]}, 0x48}, 0x1, 0x0, 0x0, 0x4004000}, 0x0) (async)
syz_genetlink_get_family_id$tipc2(&(0x7f0000000040), r1)
r2 = fsopen(&(0x7f00000000c0)='ubifs\x00', 0x1)
fsconfig$FSCONFIG_SET_STRING(r2, 0x1, &(0x7f0000000000)='source', &(0x7f0000000040), 0x0)
fsconfig$FSCONFIG_CMD_CREATE(r2, 0x6, 0x0, 0x0, 0x0) (async, rerun: 32)
sendmsg$IPCTNL_MSG_EXP_GET(r0, &(0x7f0000006680)={0x0, 0x0, &(0x7f0000006640)={&(0x7f0000000240)=ANY=[@ANYBLOB="580000000102010100000000000000000a0000013c0001802c00018014000300ff01000000000000000000000000000114000400000000000000000000000000000000010c0002800500010095000004060007"], 0x58}, 0x1, 0x0, 0x0, 0xc0}, 0x8d0) (rerun: 32)
executing program 3:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$ethtool(&(0x7f00000002c0), r0)
r2 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IP_VS_SO_SET_ADD(r2, 0x0, 0x482, &(0x7f00000008c0)={0x84, @rand_addr=0x64010102, 0x4e22, 0x1, 'none\x00', 0x0, 0x10002, 0x6f}, 0x2c)
setsockopt$IP_VS_SO_SET_DEL(r2, 0x0, 0x483, &(0x7f0000001280)={0x20000000000084, @private=0xa010102, 0x4e24, 0x200000001, 'wrr\x00', 0x9, 0x821}, 0x2c)
sendmsg$ETHTOOL_MSG_LINKMODES_SET(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000080)=ANY=[@ANYBLOB="14000000", @ANYRES16=r1, @ANYBLOB="090300000000000000002e"], 0x14}}, 0x0)
socket$nl_generic(0x10, 0x3, 0x10) (async)
syz_genetlink_get_family_id$ethtool(&(0x7f00000002c0), r0) (async)
socket$inet_icmp_raw(0x2, 0x3, 0x1) (async)
setsockopt$IP_VS_SO_SET_ADD(r2, 0x0, 0x482, &(0x7f00000008c0)={0x84, @rand_addr=0x64010102, 0x4e22, 0x1, 'none\x00', 0x0, 0x10002, 0x6f}, 0x2c) (async)
setsockopt$IP_VS_SO_SET_DEL(r2, 0x0, 0x483, &(0x7f0000001280)={0x20000000000084, @private=0xa010102, 0x4e24, 0x200000001, 'wrr\x00', 0x9, 0x821}, 0x2c) (async)
sendmsg$ETHTOOL_MSG_LINKMODES_SET(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000080)=ANY=[@ANYBLOB="14000000", @ANYRES16=r1, @ANYBLOB="090300000000000000002e"], 0x14}}, 0x0) (async)
executing program 2:
getrandom(&(0x7f0000000240)=""/286, 0xffffff9a, 0x0)
r0 = syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3)
connect$bt_rfcomm(r0, &(0x7f00000003c0)={0x1f, @none, 0x8}, 0xa)
getsockopt$sock_buf(r0, 0x1, 0x1c, 0x0, &(0x7f0000004c00))
capget(&(0x7f00000000c0)={0x19980330}, &(0x7f0000000100)={0x4, 0xfffffff7, 0x4, 0x8, 0x6, 0xffff})
r1 = socket$inet6_tcp(0xa, 0x1, 0x0)
r2 = dup(r1)
ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x9af139be227d9862}})
ioctl$TIOCMIWAIT(r2, 0x545c, 0x0)
r3 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000000)=ANY=[@ANYBLOB="500100001a00330600000000fddbdf25fe8000000000000000000000000000aafe8000000000000000000000000000aa000040002c6c80050000800000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="fe8000000000000000000000000000bb000000003200000000000000000000000000000000000001230300000000000001000080000000000000000000000000c0000000000000000040000000000000000000000000000000000000000000000800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000029bd7000033500000a000500000000000000000048000200656362286369706865725f6e756c6c290000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000005002100020000000800280000000000080027"], 0x150}, 0x1, 0x0, 0x0, 0x4000}, 0x200080d4)
r4 = openat(0xffffffffffffffff, &(0x7f00000000c0)='./file1\x00', 0x281c2, 0x0)
r5 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$inet6_int(r5, 0x29, 0x35, &(0x7f0000000000)=0x7907, 0x4)
bind$inet6(r5, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x7ff, @empty, 0x9}, 0x1c)
recvmmsg(r5, &(0x7f0000000240)=[{{0x0, 0x0, 0x0}, 0x8}], 0x1, 0x2, 0x0)
sendto$inet6(r2, 0x0, 0x0, 0x20004184, &(0x7f0000000200)={0xa, 0x4e20, 0x0, @local}, 0x1c)
r6 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$inet_tcp_int(r6, 0x6, 0x210000000013, &(0x7f0000000040)=0x100000001, 0x4)
setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r4, 0x6, 0x14, &(0x7f0000000140)=0x2, 0x4)
getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r6, 0x6, 0x15, 0x0, &(0x7f0000001880))
fcntl$setlease(r4, 0x400, 0x1)
fcntl$getflags(r4, 0x401)
ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_CLIENT(r4, 0xc04c5349, &(0x7f0000000040)={0x1, 0xfc, 0x8})
r7 = socket$inet6_tcp(0xa, 0x1, 0x0)
r8 = syz_open_dev$ttys(0xc, 0x2, 0x0)
ioctl$GIO_CMAP(r8, 0x4b70, &(0x7f0000000000))
syz_usb_connect(0x0, 0x24, &(0x7f00000001c0)=ANY=[@ANYBLOB="12010000b5b30a40450c056055b5010203010902120001000000000904", @ANYRES64=r7], 0x0)
ioctl$TIOCGPTLCK(r8, 0x5420, &(0x7f0000001d40))
getsockopt$inet6_tcp_buf(r7, 0x6, 0x1a, 0x0, &(0x7f00000003c0))
executing program 3:
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x44040}, 0x4000000)
socket$nl_netfilter(0x10, 0x3, 0xc)
socketpair$nbd(0x1, 0x1, 0x0, 0x0)
ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8923, &(0x7f0000000040)={'wlan1\x00', @random="2e2ee363a4b1"})
executing program 0:
r0 = syz_open_dev$sndctrl(&(0x7f0000001440), 0x0, 0x0)
ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(r0, 0x40045532, &(0x7f0000000100))
r1 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0), 0x88602, 0x0)
ioctl$SNDCTL_DSP_GETODELAY(r1, 0x80045017, 0x0)
r2 = syz_open_dev$sndpcmp(&(0x7f00000001c0), 0x0, 0xa2c65)
r3 = syz_usb_connect(0x0, 0x3f, &(0x7f00000000c0)=ANY=[@ANYBLOB="11010000733336088dee1adb23610000000109022d0001100000000904000003fe03010009cd8d1f000200000009050502000000001009058b1e20"], 0x0)
sendmsg$nl_route_sched_retired(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000ac0)=@newtclass={0x24, 0x28, 0x8, 0x70bd2a, 0x25dfdbfc, {0x0, 0x0, 0x0, 0x0, {0x7, 0x8}, {0xfff3, 0xf}, {0x4, 0xfff1}}}, 0x24}, 0x1, 0x0, 0x0, 0x81c1}, 0x9080)
syz_usb_control_io$printer(r3, 0x0, &(0x7f0000000800)={0x34, &(0x7f0000000500)={0x20, 0x13}, 0x0, 0x0, 0x0, 0x0, 0x0})
r4 = syz_open_dev$char_usb(0xc, 0xb4, 0x0)
ioctl$FS_IOC_GETVERSION(r4, 0xc0145b0e, &(0x7f0000000040))
pselect6(0x40, &(0x7f0000000100)={0x2, 0xfffffffffffffffe, 0x2, 0x64000000, 0x1, 0x0, 0xffffff7ffffffffd}, 0x0, &(0x7f0000000240)={0x1f, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x6}, &(0x7f0000000280)={0x0, 0x3938700}, 0x0)
ioctl$SNDRV_PCM_IOCTL_SW_PARAMS(r2, 0x4112, 0x0)
ioctl$SNDCTL_DSP_GETOPTR(r1, 0x800c5012, &(0x7f0000000200))
syz_usb_connect$uac1(0x3, 0x72, &(0x7f0000000480)={{0x12, 0x1, 0x201, 0x0, 0x0, 0x0, 0x8, 0x2b73, 0x1b, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x60, 0x3, 0x1, 0xc, 0x20, 0x0, "", {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, {{0xa, 0x24, 0x1, 0x3, 0xa}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x10, 0x8, 0x6, 0x9, {0x7, 0x25, 0x1, 0x8, 0x9, 0x8}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x8, 0x4, 0x7, 0x7, {0x7, 0x25, 0x1, 0xc, 0x4, 0x9}}}}}}}}]}}, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x1, [{0x55, &(0x7f0000000040)=@string={0x55, 0x3, "e10280f5c41ad0517e7ec5227719b6e3815873c33805db7de9f9bc78b91178319e7eab78aca5938d14eedeb4a3f09135eedd3595144401eba0487d8c4a0d1e9769dd350152d50e2e3c1760096608fda07cbe7a"}}]})
executing program 3:
r0 = syz_open_dev$vim2m(&(0x7f0000000000), 0x800, 0x2)
ioctl$VIDIOC_G_SELECTION(r0, 0xc040565e, &(0x7f0000000180)={0x2, 0x1000000, 0x0, {0x4, 0x23, 0x0, 0x6}})
executing program 3:
r0 = socket$inet6(0xa, 0x3, 0x5)
connect$inet6(r0, &(0x7f0000000100)={0xa, 0x4e21, 0x5, @loopback, 0x3ff}, 0x1c)
sendmmsg(r0, &(0x7f0000001500)=[{{&(0x7f0000000180)=@l2tp6={0xa, 0x500, 0x80000, @remote, 0x0, 0x3}, 0x80, 0x0}, 0x5b4}], 0x1, 0xc040)
r1 = socket$packet(0x11, 0x3, 0x300)
getsockopt$packet_buf(r1, 0x107, 0x18, 0x0, &(0x7f0000000380))
syz_open_dev$vim2m(&(0x7f0000000000), 0x7ff, 0x2)
r2 = syz_open_dev$swradio(&(0x7f00000000c0), 0x0, 0x2)
ioctl$VIDIOC_G_SELECTION(r2, 0xc040565e, &(0x7f0000000140)={0x2, 0x1, 0x4, {0x3, 0x26, 0x40, 0x6}})
ioctl$NILFS_IOCTL_CHANGE_CPMODE(0xffffffffffffffff, 0x40106e80, &(0x7f0000000040)={0x6, 0x1})

program crashed: possible deadlock in l2cap_chan_connect
bisect: bisecting 13 programs
bisect: split chunks (needed=false): <12>
bisect: split chunk #0 of len 12 into 3 parts
bisect: testing without sub-chunk 1/3
testing program (duration=1m42s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [29, 6, 8, 12, 30, 5, 14, 2, 9]
detailed listing:
executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) (async)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x1)
r3 = socket$netlink(0x10, 0x3, 0x0)
setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(r3, 0x10e, 0xc, &(0x7f0000000640)=0x7, 0x4) (async)
setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(r3, 0x10e, 0xc, &(0x7f0000000640)=0x7, 0x4)
sendmsg$netlink(r3, &(0x7f0000001080)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000300)={0x2c, 0x12, 0x1, 0x70bd26, 0x25dfdbfe, "", [@nested={0x10, 0x0, 0x0, 0x0, [@typed={0xc, 0xce, 0x0, 0x0, @u64}]}, @nested={0xc, 0x35, 0x0, 0x1, [@typed={0x8, 0x68, 0x0, 0x0, @u32=0x2da6}]}]}, 0x2c}], 0x1, 0x0, 0x0, 0x4000}, 0x4000800) (async)
sendmsg$netlink(r3, &(0x7f0000001080)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000300)={0x2c, 0x12, 0x1, 0x70bd26, 0x25dfdbfe, "", [@nested={0x10, 0x0, 0x0, 0x0, [@typed={0xc, 0xce, 0x0, 0x0, @u64}]}, @nested={0xc, 0x35, 0x0, 0x1, [@typed={0x8, 0x68, 0x0, 0x0, @u32=0x2da6}]}]}, 0x2c}], 0x1, 0x0, 0x0, 0x4000}, 0x4000800)
r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x1e9100, 0x0)
r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0)
syz_emit_vhci(&(0x7f0000001a40)=@HCI_EVENT_PKT={0x4, @hci_ev_auth_complete={{0x6, 0x3}, {0x0, 0xc9}}}, 0x6)
ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x2) (async)
r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x2)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r6, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000180)=[@text64={0x40, 0x0}], 0x1, 0x54, 0x0, 0x0) (async)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r6, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000180)=[@text64={0x40, 0x0}], 0x1, 0x54, 0x0, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000014000/0x18000)=nil, &(0x7f0000000100)=[@text64={0x40, 0x0}], 0x1, 0x4a, 0x0, 0x0)
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000100)={{0x14}, [@NFT_MSG_NEWTABLE={0x14, 0x0, 0xa, 0x101, 0x0, 0x0, {0x2}}], {0x14}}, 0x3c}}, 0x0)
syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@textreal={0x8, 0x0}], 0x1, 0x7a, 0x0, 0x0)
setns(0xc9, 0x0)
r7 = socket$nl_generic(0x10, 0x3, 0x10)
r8 = socket$nl_netfilter(0x10, 0x3, 0xc)
syz_genetlink_get_family_id$nl80211(&(0x7f0000000340), r7) (async)
r9 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000340), r7)
ioctl$sock_SIOCGIFINDEX_80211(r8, 0x8933, &(0x7f0000000380)={'wlan1\x00'}) (async)
ioctl$sock_SIOCGIFINDEX_80211(r8, 0x8933, &(0x7f0000000380)={'wlan1\x00', <r10=>0x0})
sendmsg$NL80211_CMD_DISCONNECT(r7, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000400)={&(0x7f00000003c0)={0x1c, r9, 0x1, 0x70bd2d, 0x25dfdbfb, {{}, {@val={0x8, 0x3, r10}, @void}}}, 0x1c}, 0x1, 0x0, 0x0, 0x8090}, 0x8814)
socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040))
ioctl$KVM_RUN(r2, 0xae80, 0x0)
executing program 2:
r0 = socket$inet_mptcp(0x2, 0x1, 0x106)
connect$inet(r0, &(0x7f0000000380)={0x2, 0x4e20, @local}, 0x10)
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={0x0}}, 0x4008800) (async)
getsockopt$inet_mptcp_buf(r0, 0x11c, 0x4, &(0x7f00000000c0)=""/191, &(0x7f0000000080)=0xbf) (async)
openat$mice(0xffffffffffffff9c, &(0x7f0000001200), 0x80000) (async)
openat$mice(0xffffffffffffff9c, &(0x7f0000001400), 0x105000)
executing program 3:
r0 = socket$nl_netfilter(0x10, 0x3, 0xc) (async)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)={0x48, 0x42, 0x1, 0x0, 0x0, {0x3, 0x1}, [@generic="0f000000", @typed={0x26, 0x1, 0x0, 0x0, @binary="d0d4c292c54d4e968899aabb08004500001c00000000010100000101010102020202"}, @nested={0x4, 0x8002}, @nested={0x4, 0x8003}]}, 0x48}, 0x1, 0x0, 0x0, 0x4004000}, 0x0) (async)
syz_genetlink_get_family_id$tipc2(&(0x7f0000000040), r1)
r2 = fsopen(&(0x7f00000000c0)='ubifs\x00', 0x1)
fsconfig$FSCONFIG_SET_STRING(r2, 0x1, &(0x7f0000000000)='source', &(0x7f0000000040), 0x0)
fsconfig$FSCONFIG_CMD_CREATE(r2, 0x6, 0x0, 0x0, 0x0) (async, rerun: 32)
sendmsg$IPCTNL_MSG_EXP_GET(r0, &(0x7f0000006680)={0x0, 0x0, &(0x7f0000006640)={&(0x7f0000000240)=ANY=[@ANYBLOB="580000000102010100000000000000000a0000013c0001802c00018014000300ff01000000000000000000000000000114000400000000000000000000000000000000010c0002800500010095000004060007"], 0x58}, 0x1, 0x0, 0x0, 0xc0}, 0x8d0) (rerun: 32)
executing program 3:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$ethtool(&(0x7f00000002c0), r0)
r2 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IP_VS_SO_SET_ADD(r2, 0x0, 0x482, &(0x7f00000008c0)={0x84, @rand_addr=0x64010102, 0x4e22, 0x1, 'none\x00', 0x0, 0x10002, 0x6f}, 0x2c)
setsockopt$IP_VS_SO_SET_DEL(r2, 0x0, 0x483, &(0x7f0000001280)={0x20000000000084, @private=0xa010102, 0x4e24, 0x200000001, 'wrr\x00', 0x9, 0x821}, 0x2c)
sendmsg$ETHTOOL_MSG_LINKMODES_SET(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000080)=ANY=[@ANYBLOB="14000000", @ANYRES16=r1, @ANYBLOB="090300000000000000002e"], 0x14}}, 0x0)
socket$nl_generic(0x10, 0x3, 0x10) (async)
syz_genetlink_get_family_id$ethtool(&(0x7f00000002c0), r0) (async)
socket$inet_icmp_raw(0x2, 0x3, 0x1) (async)
setsockopt$IP_VS_SO_SET_ADD(r2, 0x0, 0x482, &(0x7f00000008c0)={0x84, @rand_addr=0x64010102, 0x4e22, 0x1, 'none\x00', 0x0, 0x10002, 0x6f}, 0x2c) (async)
setsockopt$IP_VS_SO_SET_DEL(r2, 0x0, 0x483, &(0x7f0000001280)={0x20000000000084, @private=0xa010102, 0x4e24, 0x200000001, 'wrr\x00', 0x9, 0x821}, 0x2c) (async)
sendmsg$ETHTOOL_MSG_LINKMODES_SET(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000080)=ANY=[@ANYBLOB="14000000", @ANYRES16=r1, @ANYBLOB="090300000000000000002e"], 0x14}}, 0x0) (async)
executing program 2:
getrandom(&(0x7f0000000240)=""/286, 0xffffff9a, 0x0)
r0 = syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3)
connect$bt_rfcomm(r0, &(0x7f00000003c0)={0x1f, @none, 0x8}, 0xa)
getsockopt$sock_buf(r0, 0x1, 0x1c, 0x0, &(0x7f0000004c00))
capget(&(0x7f00000000c0)={0x19980330}, &(0x7f0000000100)={0x4, 0xfffffff7, 0x4, 0x8, 0x6, 0xffff})
r1 = socket$inet6_tcp(0xa, 0x1, 0x0)
r2 = dup(r1)
ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x9af139be227d9862}})
ioctl$TIOCMIWAIT(r2, 0x545c, 0x0)
r3 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000000)=ANY=[@ANYBLOB="500100001a00330600000000fddbdf25fe8000000000000000000000000000aafe8000000000000000000000000000aa000040002c6c80050000800000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="fe8000000000000000000000000000bb000000003200000000000000000000000000000000000001230300000000000001000080000000000000000000000000c0000000000000000040000000000000000000000000000000000000000000000800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000029bd7000033500000a000500000000000000000048000200656362286369706865725f6e756c6c290000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000005002100020000000800280000000000080027"], 0x150}, 0x1, 0x0, 0x0, 0x4000}, 0x200080d4)
r4 = openat(0xffffffffffffffff, &(0x7f00000000c0)='./file1\x00', 0x281c2, 0x0)
r5 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$inet6_int(r5, 0x29, 0x35, &(0x7f0000000000)=0x7907, 0x4)
bind$inet6(r5, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x7ff, @empty, 0x9}, 0x1c)
recvmmsg(r5, &(0x7f0000000240)=[{{0x0, 0x0, 0x0}, 0x8}], 0x1, 0x2, 0x0)
sendto$inet6(r2, 0x0, 0x0, 0x20004184, &(0x7f0000000200)={0xa, 0x4e20, 0x0, @local}, 0x1c)
r6 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$inet_tcp_int(r6, 0x6, 0x210000000013, &(0x7f0000000040)=0x100000001, 0x4)
setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r4, 0x6, 0x14, &(0x7f0000000140)=0x2, 0x4)
getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r6, 0x6, 0x15, 0x0, &(0x7f0000001880))
fcntl$setlease(r4, 0x400, 0x1)
fcntl$getflags(r4, 0x401)
ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_CLIENT(r4, 0xc04c5349, &(0x7f0000000040)={0x1, 0xfc, 0x8})
r7 = socket$inet6_tcp(0xa, 0x1, 0x0)
r8 = syz_open_dev$ttys(0xc, 0x2, 0x0)
ioctl$GIO_CMAP(r8, 0x4b70, &(0x7f0000000000))
syz_usb_connect(0x0, 0x24, &(0x7f00000001c0)=ANY=[@ANYBLOB="12010000b5b30a40450c056055b5010203010902120001000000000904", @ANYRES64=r7], 0x0)
ioctl$TIOCGPTLCK(r8, 0x5420, &(0x7f0000001d40))
getsockopt$inet6_tcp_buf(r7, 0x6, 0x1a, 0x0, &(0x7f00000003c0))
executing program 3:
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x44040}, 0x4000000)
socket$nl_netfilter(0x10, 0x3, 0xc)
socketpair$nbd(0x1, 0x1, 0x0, 0x0)
ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8923, &(0x7f0000000040)={'wlan1\x00', @random="2e2ee363a4b1"})
executing program 0:
r0 = syz_open_dev$sndctrl(&(0x7f0000001440), 0x0, 0x0)
ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(r0, 0x40045532, &(0x7f0000000100))
r1 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0), 0x88602, 0x0)
ioctl$SNDCTL_DSP_GETODELAY(r1, 0x80045017, 0x0)
r2 = syz_open_dev$sndpcmp(&(0x7f00000001c0), 0x0, 0xa2c65)
r3 = syz_usb_connect(0x0, 0x3f, &(0x7f00000000c0)=ANY=[@ANYBLOB="11010000733336088dee1adb23610000000109022d0001100000000904000003fe03010009cd8d1f000200000009050502000000001009058b1e20"], 0x0)
sendmsg$nl_route_sched_retired(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000ac0)=@newtclass={0x24, 0x28, 0x8, 0x70bd2a, 0x25dfdbfc, {0x0, 0x0, 0x0, 0x0, {0x7, 0x8}, {0xfff3, 0xf}, {0x4, 0xfff1}}}, 0x24}, 0x1, 0x0, 0x0, 0x81c1}, 0x9080)
syz_usb_control_io$printer(r3, 0x0, &(0x7f0000000800)={0x34, &(0x7f0000000500)={0x20, 0x13}, 0x0, 0x0, 0x0, 0x0, 0x0})
r4 = syz_open_dev$char_usb(0xc, 0xb4, 0x0)
ioctl$FS_IOC_GETVERSION(r4, 0xc0145b0e, &(0x7f0000000040))
pselect6(0x40, &(0x7f0000000100)={0x2, 0xfffffffffffffffe, 0x2, 0x64000000, 0x1, 0x0, 0xffffff7ffffffffd}, 0x0, &(0x7f0000000240)={0x1f, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x6}, &(0x7f0000000280)={0x0, 0x3938700}, 0x0)
ioctl$SNDRV_PCM_IOCTL_SW_PARAMS(r2, 0x4112, 0x0)
ioctl$SNDCTL_DSP_GETOPTR(r1, 0x800c5012, &(0x7f0000000200))
syz_usb_connect$uac1(0x3, 0x72, &(0x7f0000000480)={{0x12, 0x1, 0x201, 0x0, 0x0, 0x0, 0x8, 0x2b73, 0x1b, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x60, 0x3, 0x1, 0xc, 0x20, 0x0, "", {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, {{0xa, 0x24, 0x1, 0x3, 0xa}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x10, 0x8, 0x6, 0x9, {0x7, 0x25, 0x1, 0x8, 0x9, 0x8}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x8, 0x4, 0x7, 0x7, {0x7, 0x25, 0x1, 0xc, 0x4, 0x9}}}}}}}}]}}, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x1, [{0x55, &(0x7f0000000040)=@string={0x55, 0x3, "e10280f5c41ad0517e7ec5227719b6e3815873c33805db7de9f9bc78b91178319e7eab78aca5938d14eedeb4a3f09135eedd3595144401eba0487d8c4a0d1e9769dd350152d50e2e3c1760096608fda07cbe7a"}}]})
executing program 3:
r0 = syz_open_dev$vim2m(&(0x7f0000000000), 0x800, 0x2)
ioctl$VIDIOC_G_SELECTION(r0, 0xc040565e, &(0x7f0000000180)={0x2, 0x1000000, 0x0, {0x4, 0x23, 0x0, 0x6}})
executing program 3:
r0 = socket$inet6(0xa, 0x3, 0x5)
connect$inet6(r0, &(0x7f0000000100)={0xa, 0x4e21, 0x5, @loopback, 0x3ff}, 0x1c)
sendmmsg(r0, &(0x7f0000001500)=[{{&(0x7f0000000180)=@l2tp6={0xa, 0x500, 0x80000, @remote, 0x0, 0x3}, 0x80, 0x0}, 0x5b4}], 0x1, 0xc040)
r1 = socket$packet(0x11, 0x3, 0x300)
getsockopt$packet_buf(r1, 0x107, 0x18, 0x0, &(0x7f0000000380))
syz_open_dev$vim2m(&(0x7f0000000000), 0x7ff, 0x2)
r2 = syz_open_dev$swradio(&(0x7f00000000c0), 0x0, 0x2)
ioctl$VIDIOC_G_SELECTION(r2, 0xc040565e, &(0x7f0000000140)={0x2, 0x1, 0x4, {0x3, 0x26, 0x40, 0x6}})
ioctl$NILFS_IOCTL_CHANGE_CPMODE(0xffffffffffffffff, 0x40106e80, &(0x7f0000000040)={0x6, 0x1})

program crashed: possible deadlock in l2cap_chan_connect
bisect: the chunk can be dropped
bisect: testing without sub-chunk 2/3
testing program (duration=1m41s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [30, 5, 14, 2, 9]
detailed listing:
executing program 2:
getrandom(&(0x7f0000000240)=""/286, 0xffffff9a, 0x0)
r0 = syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3)
connect$bt_rfcomm(r0, &(0x7f00000003c0)={0x1f, @none, 0x8}, 0xa)
getsockopt$sock_buf(r0, 0x1, 0x1c, 0x0, &(0x7f0000004c00))
capget(&(0x7f00000000c0)={0x19980330}, &(0x7f0000000100)={0x4, 0xfffffff7, 0x4, 0x8, 0x6, 0xffff})
r1 = socket$inet6_tcp(0xa, 0x1, 0x0)
r2 = dup(r1)
ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x9af139be227d9862}})
ioctl$TIOCMIWAIT(r2, 0x545c, 0x0)
r3 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000000)=ANY=[@ANYBLOB="500100001a00330600000000fddbdf25fe8000000000000000000000000000aafe8000000000000000000000000000aa000040002c6c80050000800000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="fe8000000000000000000000000000bb000000003200000000000000000000000000000000000001230300000000000001000080000000000000000000000000c0000000000000000040000000000000000000000000000000000000000000000800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000029bd7000033500000a000500000000000000000048000200656362286369706865725f6e756c6c290000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000005002100020000000800280000000000080027"], 0x150}, 0x1, 0x0, 0x0, 0x4000}, 0x200080d4)
r4 = openat(0xffffffffffffffff, &(0x7f00000000c0)='./file1\x00', 0x281c2, 0x0)
r5 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$inet6_int(r5, 0x29, 0x35, &(0x7f0000000000)=0x7907, 0x4)
bind$inet6(r5, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x7ff, @empty, 0x9}, 0x1c)
recvmmsg(r5, &(0x7f0000000240)=[{{0x0, 0x0, 0x0}, 0x8}], 0x1, 0x2, 0x0)
sendto$inet6(r2, 0x0, 0x0, 0x20004184, &(0x7f0000000200)={0xa, 0x4e20, 0x0, @local}, 0x1c)
r6 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$inet_tcp_int(r6, 0x6, 0x210000000013, &(0x7f0000000040)=0x100000001, 0x4)
setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r4, 0x6, 0x14, &(0x7f0000000140)=0x2, 0x4)
getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r6, 0x6, 0x15, 0x0, &(0x7f0000001880))
fcntl$setlease(r4, 0x400, 0x1)
fcntl$getflags(r4, 0x401)
ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_CLIENT(r4, 0xc04c5349, &(0x7f0000000040)={0x1, 0xfc, 0x8})
r7 = socket$inet6_tcp(0xa, 0x1, 0x0)
r8 = syz_open_dev$ttys(0xc, 0x2, 0x0)
ioctl$GIO_CMAP(r8, 0x4b70, &(0x7f0000000000))
syz_usb_connect(0x0, 0x24, &(0x7f00000001c0)=ANY=[@ANYBLOB="12010000b5b30a40450c056055b5010203010902120001000000000904", @ANYRES64=r7], 0x0)
ioctl$TIOCGPTLCK(r8, 0x5420, &(0x7f0000001d40))
getsockopt$inet6_tcp_buf(r7, 0x6, 0x1a, 0x0, &(0x7f00000003c0))
executing program 3:
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x44040}, 0x4000000)
socket$nl_netfilter(0x10, 0x3, 0xc)
socketpair$nbd(0x1, 0x1, 0x0, 0x0)
ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8923, &(0x7f0000000040)={'wlan1\x00', @random="2e2ee363a4b1"})
executing program 0:
r0 = syz_open_dev$sndctrl(&(0x7f0000001440), 0x0, 0x0)
ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(r0, 0x40045532, &(0x7f0000000100))
r1 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0), 0x88602, 0x0)
ioctl$SNDCTL_DSP_GETODELAY(r1, 0x80045017, 0x0)
r2 = syz_open_dev$sndpcmp(&(0x7f00000001c0), 0x0, 0xa2c65)
r3 = syz_usb_connect(0x0, 0x3f, &(0x7f00000000c0)=ANY=[@ANYBLOB="11010000733336088dee1adb23610000000109022d0001100000000904000003fe03010009cd8d1f000200000009050502000000001009058b1e20"], 0x0)
sendmsg$nl_route_sched_retired(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000ac0)=@newtclass={0x24, 0x28, 0x8, 0x70bd2a, 0x25dfdbfc, {0x0, 0x0, 0x0, 0x0, {0x7, 0x8}, {0xfff3, 0xf}, {0x4, 0xfff1}}}, 0x24}, 0x1, 0x0, 0x0, 0x81c1}, 0x9080)
syz_usb_control_io$printer(r3, 0x0, &(0x7f0000000800)={0x34, &(0x7f0000000500)={0x20, 0x13}, 0x0, 0x0, 0x0, 0x0, 0x0})
r4 = syz_open_dev$char_usb(0xc, 0xb4, 0x0)
ioctl$FS_IOC_GETVERSION(r4, 0xc0145b0e, &(0x7f0000000040))
pselect6(0x40, &(0x7f0000000100)={0x2, 0xfffffffffffffffe, 0x2, 0x64000000, 0x1, 0x0, 0xffffff7ffffffffd}, 0x0, &(0x7f0000000240)={0x1f, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x6}, &(0x7f0000000280)={0x0, 0x3938700}, 0x0)
ioctl$SNDRV_PCM_IOCTL_SW_PARAMS(r2, 0x4112, 0x0)
ioctl$SNDCTL_DSP_GETOPTR(r1, 0x800c5012, &(0x7f0000000200))
syz_usb_connect$uac1(0x3, 0x72, &(0x7f0000000480)={{0x12, 0x1, 0x201, 0x0, 0x0, 0x0, 0x8, 0x2b73, 0x1b, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x60, 0x3, 0x1, 0xc, 0x20, 0x0, "", {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, {{0xa, 0x24, 0x1, 0x3, 0xa}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x10, 0x8, 0x6, 0x9, {0x7, 0x25, 0x1, 0x8, 0x9, 0x8}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x8, 0x4, 0x7, 0x7, {0x7, 0x25, 0x1, 0xc, 0x4, 0x9}}}}}}}}]}}, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x1, [{0x55, &(0x7f0000000040)=@string={0x55, 0x3, "e10280f5c41ad0517e7ec5227719b6e3815873c33805db7de9f9bc78b91178319e7eab78aca5938d14eedeb4a3f09135eedd3595144401eba0487d8c4a0d1e9769dd350152d50e2e3c1760096608fda07cbe7a"}}]})
executing program 3:
r0 = syz_open_dev$vim2m(&(0x7f0000000000), 0x800, 0x2)
ioctl$VIDIOC_G_SELECTION(r0, 0xc040565e, &(0x7f0000000180)={0x2, 0x1000000, 0x0, {0x4, 0x23, 0x0, 0x6}})
executing program 3:
r0 = socket$inet6(0xa, 0x3, 0x5)
connect$inet6(r0, &(0x7f0000000100)={0xa, 0x4e21, 0x5, @loopback, 0x3ff}, 0x1c)
sendmmsg(r0, &(0x7f0000001500)=[{{&(0x7f0000000180)=@l2tp6={0xa, 0x500, 0x80000, @remote, 0x0, 0x3}, 0x80, 0x0}, 0x5b4}], 0x1, 0xc040)
r1 = socket$packet(0x11, 0x3, 0x300)
getsockopt$packet_buf(r1, 0x107, 0x18, 0x0, &(0x7f0000000380))
syz_open_dev$vim2m(&(0x7f0000000000), 0x7ff, 0x2)
r2 = syz_open_dev$swradio(&(0x7f00000000c0), 0x0, 0x2)
ioctl$VIDIOC_G_SELECTION(r2, 0xc040565e, &(0x7f0000000140)={0x2, 0x1, 0x4, {0x3, 0x26, 0x40, 0x6}})
ioctl$NILFS_IOCTL_CHANGE_CPMODE(0xffffffffffffffff, 0x40106e80, &(0x7f0000000040)={0x6, 0x1})

program did not crash
bisect: testing without sub-chunk 3/3
testing program (duration=1m41s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [29, 6, 8, 12, 30]
detailed listing:
executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) (async)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x1)
r3 = socket$netlink(0x10, 0x3, 0x0)
setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(r3, 0x10e, 0xc, &(0x7f0000000640)=0x7, 0x4) (async)
setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(r3, 0x10e, 0xc, &(0x7f0000000640)=0x7, 0x4)
sendmsg$netlink(r3, &(0x7f0000001080)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000300)={0x2c, 0x12, 0x1, 0x70bd26, 0x25dfdbfe, "", [@nested={0x10, 0x0, 0x0, 0x0, [@typed={0xc, 0xce, 0x0, 0x0, @u64}]}, @nested={0xc, 0x35, 0x0, 0x1, [@typed={0x8, 0x68, 0x0, 0x0, @u32=0x2da6}]}]}, 0x2c}], 0x1, 0x0, 0x0, 0x4000}, 0x4000800) (async)
sendmsg$netlink(r3, &(0x7f0000001080)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000300)={0x2c, 0x12, 0x1, 0x70bd26, 0x25dfdbfe, "", [@nested={0x10, 0x0, 0x0, 0x0, [@typed={0xc, 0xce, 0x0, 0x0, @u64}]}, @nested={0xc, 0x35, 0x0, 0x1, [@typed={0x8, 0x68, 0x0, 0x0, @u32=0x2da6}]}]}, 0x2c}], 0x1, 0x0, 0x0, 0x4000}, 0x4000800)
r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x1e9100, 0x0)
r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0)
syz_emit_vhci(&(0x7f0000001a40)=@HCI_EVENT_PKT={0x4, @hci_ev_auth_complete={{0x6, 0x3}, {0x0, 0xc9}}}, 0x6)
ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x2) (async)
r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x2)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r6, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000180)=[@text64={0x40, 0x0}], 0x1, 0x54, 0x0, 0x0) (async)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r6, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000180)=[@text64={0x40, 0x0}], 0x1, 0x54, 0x0, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000014000/0x18000)=nil, &(0x7f0000000100)=[@text64={0x40, 0x0}], 0x1, 0x4a, 0x0, 0x0)
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000100)={{0x14}, [@NFT_MSG_NEWTABLE={0x14, 0x0, 0xa, 0x101, 0x0, 0x0, {0x2}}], {0x14}}, 0x3c}}, 0x0)
syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@textreal={0x8, 0x0}], 0x1, 0x7a, 0x0, 0x0)
setns(0xc9, 0x0)
r7 = socket$nl_generic(0x10, 0x3, 0x10)
r8 = socket$nl_netfilter(0x10, 0x3, 0xc)
syz_genetlink_get_family_id$nl80211(&(0x7f0000000340), r7) (async)
r9 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000340), r7)
ioctl$sock_SIOCGIFINDEX_80211(r8, 0x8933, &(0x7f0000000380)={'wlan1\x00'}) (async)
ioctl$sock_SIOCGIFINDEX_80211(r8, 0x8933, &(0x7f0000000380)={'wlan1\x00', <r10=>0x0})
sendmsg$NL80211_CMD_DISCONNECT(r7, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000400)={&(0x7f00000003c0)={0x1c, r9, 0x1, 0x70bd2d, 0x25dfdbfb, {{}, {@val={0x8, 0x3, r10}, @void}}}, 0x1c}, 0x1, 0x0, 0x0, 0x8090}, 0x8814)
socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040))
ioctl$KVM_RUN(r2, 0xae80, 0x0)
executing program 2:
r0 = socket$inet_mptcp(0x2, 0x1, 0x106)
connect$inet(r0, &(0x7f0000000380)={0x2, 0x4e20, @local}, 0x10)
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={0x0}}, 0x4008800) (async)
getsockopt$inet_mptcp_buf(r0, 0x11c, 0x4, &(0x7f00000000c0)=""/191, &(0x7f0000000080)=0xbf) (async)
openat$mice(0xffffffffffffff9c, &(0x7f0000001200), 0x80000) (async)
openat$mice(0xffffffffffffff9c, &(0x7f0000001400), 0x105000)
executing program 3:
r0 = socket$nl_netfilter(0x10, 0x3, 0xc) (async)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)={0x48, 0x42, 0x1, 0x0, 0x0, {0x3, 0x1}, [@generic="0f000000", @typed={0x26, 0x1, 0x0, 0x0, @binary="d0d4c292c54d4e968899aabb08004500001c00000000010100000101010102020202"}, @nested={0x4, 0x8002}, @nested={0x4, 0x8003}]}, 0x48}, 0x1, 0x0, 0x0, 0x4004000}, 0x0) (async)
syz_genetlink_get_family_id$tipc2(&(0x7f0000000040), r1)
r2 = fsopen(&(0x7f00000000c0)='ubifs\x00', 0x1)
fsconfig$FSCONFIG_SET_STRING(r2, 0x1, &(0x7f0000000000)='source', &(0x7f0000000040), 0x0)
fsconfig$FSCONFIG_CMD_CREATE(r2, 0x6, 0x0, 0x0, 0x0) (async, rerun: 32)
sendmsg$IPCTNL_MSG_EXP_GET(r0, &(0x7f0000006680)={0x0, 0x0, &(0x7f0000006640)={&(0x7f0000000240)=ANY=[@ANYBLOB="580000000102010100000000000000000a0000013c0001802c00018014000300ff01000000000000000000000000000114000400000000000000000000000000000000010c0002800500010095000004060007"], 0x58}, 0x1, 0x0, 0x0, 0xc0}, 0x8d0) (rerun: 32)
executing program 3:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$ethtool(&(0x7f00000002c0), r0)
r2 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IP_VS_SO_SET_ADD(r2, 0x0, 0x482, &(0x7f00000008c0)={0x84, @rand_addr=0x64010102, 0x4e22, 0x1, 'none\x00', 0x0, 0x10002, 0x6f}, 0x2c)
setsockopt$IP_VS_SO_SET_DEL(r2, 0x0, 0x483, &(0x7f0000001280)={0x20000000000084, @private=0xa010102, 0x4e24, 0x200000001, 'wrr\x00', 0x9, 0x821}, 0x2c)
sendmsg$ETHTOOL_MSG_LINKMODES_SET(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000080)=ANY=[@ANYBLOB="14000000", @ANYRES16=r1, @ANYBLOB="090300000000000000002e"], 0x14}}, 0x0)
socket$nl_generic(0x10, 0x3, 0x10) (async)
syz_genetlink_get_family_id$ethtool(&(0x7f00000002c0), r0) (async)
socket$inet_icmp_raw(0x2, 0x3, 0x1) (async)
setsockopt$IP_VS_SO_SET_ADD(r2, 0x0, 0x482, &(0x7f00000008c0)={0x84, @rand_addr=0x64010102, 0x4e22, 0x1, 'none\x00', 0x0, 0x10002, 0x6f}, 0x2c) (async)
setsockopt$IP_VS_SO_SET_DEL(r2, 0x0, 0x483, &(0x7f0000001280)={0x20000000000084, @private=0xa010102, 0x4e24, 0x200000001, 'wrr\x00', 0x9, 0x821}, 0x2c) (async)
sendmsg$ETHTOOL_MSG_LINKMODES_SET(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000080)=ANY=[@ANYBLOB="14000000", @ANYRES16=r1, @ANYBLOB="090300000000000000002e"], 0x14}}, 0x0) (async)
executing program 2:
getrandom(&(0x7f0000000240)=""/286, 0xffffff9a, 0x0)
r0 = syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3)
connect$bt_rfcomm(r0, &(0x7f00000003c0)={0x1f, @none, 0x8}, 0xa)
getsockopt$sock_buf(r0, 0x1, 0x1c, 0x0, &(0x7f0000004c00))
capget(&(0x7f00000000c0)={0x19980330}, &(0x7f0000000100)={0x4, 0xfffffff7, 0x4, 0x8, 0x6, 0xffff})
r1 = socket$inet6_tcp(0xa, 0x1, 0x0)
r2 = dup(r1)
ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x9af139be227d9862}})
ioctl$TIOCMIWAIT(r2, 0x545c, 0x0)
r3 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000000)=ANY=[@ANYBLOB="500100001a00330600000000fddbdf25fe8000000000000000000000000000aafe8000000000000000000000000000aa000040002c6c80050000800000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="fe8000000000000000000000000000bb000000003200000000000000000000000000000000000001230300000000000001000080000000000000000000000000c0000000000000000040000000000000000000000000000000000000000000000800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000029bd7000033500000a000500000000000000000048000200656362286369706865725f6e756c6c290000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000005002100020000000800280000000000080027"], 0x150}, 0x1, 0x0, 0x0, 0x4000}, 0x200080d4)
r4 = openat(0xffffffffffffffff, &(0x7f00000000c0)='./file1\x00', 0x281c2, 0x0)
r5 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$inet6_int(r5, 0x29, 0x35, &(0x7f0000000000)=0x7907, 0x4)
bind$inet6(r5, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x7ff, @empty, 0x9}, 0x1c)
recvmmsg(r5, &(0x7f0000000240)=[{{0x0, 0x0, 0x0}, 0x8}], 0x1, 0x2, 0x0)
sendto$inet6(r2, 0x0, 0x0, 0x20004184, &(0x7f0000000200)={0xa, 0x4e20, 0x0, @local}, 0x1c)
r6 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$inet_tcp_int(r6, 0x6, 0x210000000013, &(0x7f0000000040)=0x100000001, 0x4)
setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r4, 0x6, 0x14, &(0x7f0000000140)=0x2, 0x4)
getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r6, 0x6, 0x15, 0x0, &(0x7f0000001880))
fcntl$setlease(r4, 0x400, 0x1)
fcntl$getflags(r4, 0x401)
ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_CLIENT(r4, 0xc04c5349, &(0x7f0000000040)={0x1, 0xfc, 0x8})
r7 = socket$inet6_tcp(0xa, 0x1, 0x0)
r8 = syz_open_dev$ttys(0xc, 0x2, 0x0)
ioctl$GIO_CMAP(r8, 0x4b70, &(0x7f0000000000))
syz_usb_connect(0x0, 0x24, &(0x7f00000001c0)=ANY=[@ANYBLOB="12010000b5b30a40450c056055b5010203010902120001000000000904", @ANYRES64=r7], 0x0)
ioctl$TIOCGPTLCK(r8, 0x5420, &(0x7f0000001d40))
getsockopt$inet6_tcp_buf(r7, 0x6, 0x1a, 0x0, &(0x7f00000003c0))

program crashed: possible deadlock in l2cap_chan_connect
bisect: the chunk can be dropped
bisect: split chunks (needed=true): <4>
bisect: split chunk #0 of len 4 into 2 parts
bisect: testing without sub-chunk 1/2
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [8, 12, 30]
detailed listing:
executing program 3:
r0 = socket$nl_netfilter(0x10, 0x3, 0xc) (async)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)={0x48, 0x42, 0x1, 0x0, 0x0, {0x3, 0x1}, [@generic="0f000000", @typed={0x26, 0x1, 0x0, 0x0, @binary="d0d4c292c54d4e968899aabb08004500001c00000000010100000101010102020202"}, @nested={0x4, 0x8002}, @nested={0x4, 0x8003}]}, 0x48}, 0x1, 0x0, 0x0, 0x4004000}, 0x0) (async)
syz_genetlink_get_family_id$tipc2(&(0x7f0000000040), r1)
r2 = fsopen(&(0x7f00000000c0)='ubifs\x00', 0x1)
fsconfig$FSCONFIG_SET_STRING(r2, 0x1, &(0x7f0000000000)='source', &(0x7f0000000040), 0x0)
fsconfig$FSCONFIG_CMD_CREATE(r2, 0x6, 0x0, 0x0, 0x0) (async, rerun: 32)
sendmsg$IPCTNL_MSG_EXP_GET(r0, &(0x7f0000006680)={0x0, 0x0, &(0x7f0000006640)={&(0x7f0000000240)=ANY=[@ANYBLOB="580000000102010100000000000000000a0000013c0001802c00018014000300ff01000000000000000000000000000114000400000000000000000000000000000000010c0002800500010095000004060007"], 0x58}, 0x1, 0x0, 0x0, 0xc0}, 0x8d0) (rerun: 32)
executing program 3:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$ethtool(&(0x7f00000002c0), r0)
r2 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IP_VS_SO_SET_ADD(r2, 0x0, 0x482, &(0x7f00000008c0)={0x84, @rand_addr=0x64010102, 0x4e22, 0x1, 'none\x00', 0x0, 0x10002, 0x6f}, 0x2c)
setsockopt$IP_VS_SO_SET_DEL(r2, 0x0, 0x483, &(0x7f0000001280)={0x20000000000084, @private=0xa010102, 0x4e24, 0x200000001, 'wrr\x00', 0x9, 0x821}, 0x2c)
sendmsg$ETHTOOL_MSG_LINKMODES_SET(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000080)=ANY=[@ANYBLOB="14000000", @ANYRES16=r1, @ANYBLOB="090300000000000000002e"], 0x14}}, 0x0)
socket$nl_generic(0x10, 0x3, 0x10) (async)
syz_genetlink_get_family_id$ethtool(&(0x7f00000002c0), r0) (async)
socket$inet_icmp_raw(0x2, 0x3, 0x1) (async)
setsockopt$IP_VS_SO_SET_ADD(r2, 0x0, 0x482, &(0x7f00000008c0)={0x84, @rand_addr=0x64010102, 0x4e22, 0x1, 'none\x00', 0x0, 0x10002, 0x6f}, 0x2c) (async)
setsockopt$IP_VS_SO_SET_DEL(r2, 0x0, 0x483, &(0x7f0000001280)={0x20000000000084, @private=0xa010102, 0x4e24, 0x200000001, 'wrr\x00', 0x9, 0x821}, 0x2c) (async)
sendmsg$ETHTOOL_MSG_LINKMODES_SET(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000080)=ANY=[@ANYBLOB="14000000", @ANYRES16=r1, @ANYBLOB="090300000000000000002e"], 0x14}}, 0x0) (async)
executing program 2:
getrandom(&(0x7f0000000240)=""/286, 0xffffff9a, 0x0)
r0 = syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3)
connect$bt_rfcomm(r0, &(0x7f00000003c0)={0x1f, @none, 0x8}, 0xa)
getsockopt$sock_buf(r0, 0x1, 0x1c, 0x0, &(0x7f0000004c00))
capget(&(0x7f00000000c0)={0x19980330}, &(0x7f0000000100)={0x4, 0xfffffff7, 0x4, 0x8, 0x6, 0xffff})
r1 = socket$inet6_tcp(0xa, 0x1, 0x0)
r2 = dup(r1)
ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x9af139be227d9862}})
ioctl$TIOCMIWAIT(r2, 0x545c, 0x0)
r3 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000000)=ANY=[@ANYBLOB="500100001a00330600000000fddbdf25fe8000000000000000000000000000aafe8000000000000000000000000000aa000040002c6c80050000800000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="fe8000000000000000000000000000bb000000003200000000000000000000000000000000000001230300000000000001000080000000000000000000000000c0000000000000000040000000000000000000000000000000000000000000000800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000029bd7000033500000a000500000000000000000048000200656362286369706865725f6e756c6c290000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000005002100020000000800280000000000080027"], 0x150}, 0x1, 0x0, 0x0, 0x4000}, 0x200080d4)
r4 = openat(0xffffffffffffffff, &(0x7f00000000c0)='./file1\x00', 0x281c2, 0x0)
r5 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$inet6_int(r5, 0x29, 0x35, &(0x7f0000000000)=0x7907, 0x4)
bind$inet6(r5, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x7ff, @empty, 0x9}, 0x1c)
recvmmsg(r5, &(0x7f0000000240)=[{{0x0, 0x0, 0x0}, 0x8}], 0x1, 0x2, 0x0)
sendto$inet6(r2, 0x0, 0x0, 0x20004184, &(0x7f0000000200)={0xa, 0x4e20, 0x0, @local}, 0x1c)
r6 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$inet_tcp_int(r6, 0x6, 0x210000000013, &(0x7f0000000040)=0x100000001, 0x4)
setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r4, 0x6, 0x14, &(0x7f0000000140)=0x2, 0x4)
getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r6, 0x6, 0x15, 0x0, &(0x7f0000001880))
fcntl$setlease(r4, 0x400, 0x1)
fcntl$getflags(r4, 0x401)
ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_CLIENT(r4, 0xc04c5349, &(0x7f0000000040)={0x1, 0xfc, 0x8})
r7 = socket$inet6_tcp(0xa, 0x1, 0x0)
r8 = syz_open_dev$ttys(0xc, 0x2, 0x0)
ioctl$GIO_CMAP(r8, 0x4b70, &(0x7f0000000000))
syz_usb_connect(0x0, 0x24, &(0x7f00000001c0)=ANY=[@ANYBLOB="12010000b5b30a40450c056055b5010203010902120001000000000904", @ANYRES64=r7], 0x0)
ioctl$TIOCGPTLCK(r8, 0x5420, &(0x7f0000001d40))
getsockopt$inet6_tcp_buf(r7, 0x6, 0x1a, 0x0, &(0x7f00000003c0))

program did not crash
bisect: testing without sub-chunk 2/2
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [29, 6, 30]
detailed listing:
executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) (async)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x1)
r3 = socket$netlink(0x10, 0x3, 0x0)
setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(r3, 0x10e, 0xc, &(0x7f0000000640)=0x7, 0x4) (async)
setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(r3, 0x10e, 0xc, &(0x7f0000000640)=0x7, 0x4)
sendmsg$netlink(r3, &(0x7f0000001080)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000300)={0x2c, 0x12, 0x1, 0x70bd26, 0x25dfdbfe, "", [@nested={0x10, 0x0, 0x0, 0x0, [@typed={0xc, 0xce, 0x0, 0x0, @u64}]}, @nested={0xc, 0x35, 0x0, 0x1, [@typed={0x8, 0x68, 0x0, 0x0, @u32=0x2da6}]}]}, 0x2c}], 0x1, 0x0, 0x0, 0x4000}, 0x4000800) (async)
sendmsg$netlink(r3, &(0x7f0000001080)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000300)={0x2c, 0x12, 0x1, 0x70bd26, 0x25dfdbfe, "", [@nested={0x10, 0x0, 0x0, 0x0, [@typed={0xc, 0xce, 0x0, 0x0, @u64}]}, @nested={0xc, 0x35, 0x0, 0x1, [@typed={0x8, 0x68, 0x0, 0x0, @u32=0x2da6}]}]}, 0x2c}], 0x1, 0x0, 0x0, 0x4000}, 0x4000800)
r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x1e9100, 0x0)
r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0)
syz_emit_vhci(&(0x7f0000001a40)=@HCI_EVENT_PKT={0x4, @hci_ev_auth_complete={{0x6, 0x3}, {0x0, 0xc9}}}, 0x6)
ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x2) (async)
r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x2)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r6, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000180)=[@text64={0x40, 0x0}], 0x1, 0x54, 0x0, 0x0) (async)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r6, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000180)=[@text64={0x40, 0x0}], 0x1, 0x54, 0x0, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000014000/0x18000)=nil, &(0x7f0000000100)=[@text64={0x40, 0x0}], 0x1, 0x4a, 0x0, 0x0)
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000100)={{0x14}, [@NFT_MSG_NEWTABLE={0x14, 0x0, 0xa, 0x101, 0x0, 0x0, {0x2}}], {0x14}}, 0x3c}}, 0x0)
syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@textreal={0x8, 0x0}], 0x1, 0x7a, 0x0, 0x0)
setns(0xc9, 0x0)
r7 = socket$nl_generic(0x10, 0x3, 0x10)
r8 = socket$nl_netfilter(0x10, 0x3, 0xc)
syz_genetlink_get_family_id$nl80211(&(0x7f0000000340), r7) (async)
r9 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000340), r7)
ioctl$sock_SIOCGIFINDEX_80211(r8, 0x8933, &(0x7f0000000380)={'wlan1\x00'}) (async)
ioctl$sock_SIOCGIFINDEX_80211(r8, 0x8933, &(0x7f0000000380)={'wlan1\x00', <r10=>0x0})
sendmsg$NL80211_CMD_DISCONNECT(r7, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000400)={&(0x7f00000003c0)={0x1c, r9, 0x1, 0x70bd2d, 0x25dfdbfb, {{}, {@val={0x8, 0x3, r10}, @void}}}, 0x1c}, 0x1, 0x0, 0x0, 0x8090}, 0x8814)
socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040))
ioctl$KVM_RUN(r2, 0xae80, 0x0)
executing program 2:
r0 = socket$inet_mptcp(0x2, 0x1, 0x106)
connect$inet(r0, &(0x7f0000000380)={0x2, 0x4e20, @local}, 0x10)
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={0x0}}, 0x4008800) (async)
getsockopt$inet_mptcp_buf(r0, 0x11c, 0x4, &(0x7f00000000c0)=""/191, &(0x7f0000000080)=0xbf) (async)
openat$mice(0xffffffffffffff9c, &(0x7f0000001200), 0x80000) (async)
openat$mice(0xffffffffffffff9c, &(0x7f0000001400), 0x105000)
executing program 2:
getrandom(&(0x7f0000000240)=""/286, 0xffffff9a, 0x0)
r0 = syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3)
connect$bt_rfcomm(r0, &(0x7f00000003c0)={0x1f, @none, 0x8}, 0xa)
getsockopt$sock_buf(r0, 0x1, 0x1c, 0x0, &(0x7f0000004c00))
capget(&(0x7f00000000c0)={0x19980330}, &(0x7f0000000100)={0x4, 0xfffffff7, 0x4, 0x8, 0x6, 0xffff})
r1 = socket$inet6_tcp(0xa, 0x1, 0x0)
r2 = dup(r1)
ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x9af139be227d9862}})
ioctl$TIOCMIWAIT(r2, 0x545c, 0x0)
r3 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000000)=ANY=[@ANYBLOB="500100001a00330600000000fddbdf25fe8000000000000000000000000000aafe8000000000000000000000000000aa000040002c6c80050000800000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="fe8000000000000000000000000000bb000000003200000000000000000000000000000000000001230300000000000001000080000000000000000000000000c0000000000000000040000000000000000000000000000000000000000000000800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000029bd7000033500000a000500000000000000000048000200656362286369706865725f6e756c6c290000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000005002100020000000800280000000000080027"], 0x150}, 0x1, 0x0, 0x0, 0x4000}, 0x200080d4)
r4 = openat(0xffffffffffffffff, &(0x7f00000000c0)='./file1\x00', 0x281c2, 0x0)
r5 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$inet6_int(r5, 0x29, 0x35, &(0x7f0000000000)=0x7907, 0x4)
bind$inet6(r5, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x7ff, @empty, 0x9}, 0x1c)
recvmmsg(r5, &(0x7f0000000240)=[{{0x0, 0x0, 0x0}, 0x8}], 0x1, 0x2, 0x0)
sendto$inet6(r2, 0x0, 0x0, 0x20004184, &(0x7f0000000200)={0xa, 0x4e20, 0x0, @local}, 0x1c)
r6 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$inet_tcp_int(r6, 0x6, 0x210000000013, &(0x7f0000000040)=0x100000001, 0x4)
setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r4, 0x6, 0x14, &(0x7f0000000140)=0x2, 0x4)
getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r6, 0x6, 0x15, 0x0, &(0x7f0000001880))
fcntl$setlease(r4, 0x400, 0x1)
fcntl$getflags(r4, 0x401)
ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_CLIENT(r4, 0xc04c5349, &(0x7f0000000040)={0x1, 0xfc, 0x8})
r7 = socket$inet6_tcp(0xa, 0x1, 0x0)
r8 = syz_open_dev$ttys(0xc, 0x2, 0x0)
ioctl$GIO_CMAP(r8, 0x4b70, &(0x7f0000000000))
syz_usb_connect(0x0, 0x24, &(0x7f00000001c0)=ANY=[@ANYBLOB="12010000b5b30a40450c056055b5010203010902120001000000000904", @ANYRES64=r7], 0x0)
ioctl$TIOCGPTLCK(r8, 0x5420, &(0x7f0000001d40))
getsockopt$inet6_tcp_buf(r7, 0x6, 0x1a, 0x0, &(0x7f00000003c0))

program crashed: possible deadlock in rfcomm_security_cfm
bisect: the chunk can be dropped
bisect: split chunks (needed=true): <2>
bisect: split chunk #0 of len 2 into 2 parts
bisect: testing without sub-chunk 1/2
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [6, 30]
detailed listing:
executing program 2:
r0 = socket$inet_mptcp(0x2, 0x1, 0x106)
connect$inet(r0, &(0x7f0000000380)={0x2, 0x4e20, @local}, 0x10)
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={0x0}}, 0x4008800) (async)
getsockopt$inet_mptcp_buf(r0, 0x11c, 0x4, &(0x7f00000000c0)=""/191, &(0x7f0000000080)=0xbf) (async)
openat$mice(0xffffffffffffff9c, &(0x7f0000001200), 0x80000) (async)
openat$mice(0xffffffffffffff9c, &(0x7f0000001400), 0x105000)
executing program 2:
getrandom(&(0x7f0000000240)=""/286, 0xffffff9a, 0x0)
r0 = syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3)
connect$bt_rfcomm(r0, &(0x7f00000003c0)={0x1f, @none, 0x8}, 0xa)
getsockopt$sock_buf(r0, 0x1, 0x1c, 0x0, &(0x7f0000004c00))
capget(&(0x7f00000000c0)={0x19980330}, &(0x7f0000000100)={0x4, 0xfffffff7, 0x4, 0x8, 0x6, 0xffff})
r1 = socket$inet6_tcp(0xa, 0x1, 0x0)
r2 = dup(r1)
ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x9af139be227d9862}})
ioctl$TIOCMIWAIT(r2, 0x545c, 0x0)
r3 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000000)=ANY=[@ANYBLOB="500100001a00330600000000fddbdf25fe8000000000000000000000000000aafe8000000000000000000000000000aa000040002c6c80050000800000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="fe8000000000000000000000000000bb000000003200000000000000000000000000000000000001230300000000000001000080000000000000000000000000c0000000000000000040000000000000000000000000000000000000000000000800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000029bd7000033500000a000500000000000000000048000200656362286369706865725f6e756c6c290000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000005002100020000000800280000000000080027"], 0x150}, 0x1, 0x0, 0x0, 0x4000}, 0x200080d4)
r4 = openat(0xffffffffffffffff, &(0x7f00000000c0)='./file1\x00', 0x281c2, 0x0)
r5 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$inet6_int(r5, 0x29, 0x35, &(0x7f0000000000)=0x7907, 0x4)
bind$inet6(r5, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x7ff, @empty, 0x9}, 0x1c)
recvmmsg(r5, &(0x7f0000000240)=[{{0x0, 0x0, 0x0}, 0x8}], 0x1, 0x2, 0x0)
sendto$inet6(r2, 0x0, 0x0, 0x20004184, &(0x7f0000000200)={0xa, 0x4e20, 0x0, @local}, 0x1c)
r6 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$inet_tcp_int(r6, 0x6, 0x210000000013, &(0x7f0000000040)=0x100000001, 0x4)
setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r4, 0x6, 0x14, &(0x7f0000000140)=0x2, 0x4)
getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r6, 0x6, 0x15, 0x0, &(0x7f0000001880))
fcntl$setlease(r4, 0x400, 0x1)
fcntl$getflags(r4, 0x401)
ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_CLIENT(r4, 0xc04c5349, &(0x7f0000000040)={0x1, 0xfc, 0x8})
r7 = socket$inet6_tcp(0xa, 0x1, 0x0)
r8 = syz_open_dev$ttys(0xc, 0x2, 0x0)
ioctl$GIO_CMAP(r8, 0x4b70, &(0x7f0000000000))
syz_usb_connect(0x0, 0x24, &(0x7f00000001c0)=ANY=[@ANYBLOB="12010000b5b30a40450c056055b5010203010902120001000000000904", @ANYRES64=r7], 0x0)
ioctl$TIOCGPTLCK(r8, 0x5420, &(0x7f0000001d40))
getsockopt$inet6_tcp_buf(r7, 0x6, 0x1a, 0x0, &(0x7f00000003c0))

program did not crash
bisect: testing without sub-chunk 2/2
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [29, 30]
detailed listing:
executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) (async)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x1)
r3 = socket$netlink(0x10, 0x3, 0x0)
setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(r3, 0x10e, 0xc, &(0x7f0000000640)=0x7, 0x4) (async)
setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(r3, 0x10e, 0xc, &(0x7f0000000640)=0x7, 0x4)
sendmsg$netlink(r3, &(0x7f0000001080)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000300)={0x2c, 0x12, 0x1, 0x70bd26, 0x25dfdbfe, "", [@nested={0x10, 0x0, 0x0, 0x0, [@typed={0xc, 0xce, 0x0, 0x0, @u64}]}, @nested={0xc, 0x35, 0x0, 0x1, [@typed={0x8, 0x68, 0x0, 0x0, @u32=0x2da6}]}]}, 0x2c}], 0x1, 0x0, 0x0, 0x4000}, 0x4000800) (async)
sendmsg$netlink(r3, &(0x7f0000001080)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000300)={0x2c, 0x12, 0x1, 0x70bd26, 0x25dfdbfe, "", [@nested={0x10, 0x0, 0x0, 0x0, [@typed={0xc, 0xce, 0x0, 0x0, @u64}]}, @nested={0xc, 0x35, 0x0, 0x1, [@typed={0x8, 0x68, 0x0, 0x0, @u32=0x2da6}]}]}, 0x2c}], 0x1, 0x0, 0x0, 0x4000}, 0x4000800)
r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x1e9100, 0x0)
r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0)
syz_emit_vhci(&(0x7f0000001a40)=@HCI_EVENT_PKT={0x4, @hci_ev_auth_complete={{0x6, 0x3}, {0x0, 0xc9}}}, 0x6)
ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x2) (async)
r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x2)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r6, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000180)=[@text64={0x40, 0x0}], 0x1, 0x54, 0x0, 0x0) (async)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r6, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000180)=[@text64={0x40, 0x0}], 0x1, 0x54, 0x0, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000014000/0x18000)=nil, &(0x7f0000000100)=[@text64={0x40, 0x0}], 0x1, 0x4a, 0x0, 0x0)
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000100)={{0x14}, [@NFT_MSG_NEWTABLE={0x14, 0x0, 0xa, 0x101, 0x0, 0x0, {0x2}}], {0x14}}, 0x3c}}, 0x0)
syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@textreal={0x8, 0x0}], 0x1, 0x7a, 0x0, 0x0)
setns(0xc9, 0x0)
r7 = socket$nl_generic(0x10, 0x3, 0x10)
r8 = socket$nl_netfilter(0x10, 0x3, 0xc)
syz_genetlink_get_family_id$nl80211(&(0x7f0000000340), r7) (async)
r9 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000340), r7)
ioctl$sock_SIOCGIFINDEX_80211(r8, 0x8933, &(0x7f0000000380)={'wlan1\x00'}) (async)
ioctl$sock_SIOCGIFINDEX_80211(r8, 0x8933, &(0x7f0000000380)={'wlan1\x00', <r10=>0x0})
sendmsg$NL80211_CMD_DISCONNECT(r7, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000400)={&(0x7f00000003c0)={0x1c, r9, 0x1, 0x70bd2d, 0x25dfdbfb, {{}, {@val={0x8, 0x3, r10}, @void}}}, 0x1c}, 0x1, 0x0, 0x0, 0x8090}, 0x8814)
socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040))
ioctl$KVM_RUN(r2, 0xae80, 0x0)
executing program 2:
getrandom(&(0x7f0000000240)=""/286, 0xffffff9a, 0x0)
r0 = syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3)
connect$bt_rfcomm(r0, &(0x7f00000003c0)={0x1f, @none, 0x8}, 0xa)
getsockopt$sock_buf(r0, 0x1, 0x1c, 0x0, &(0x7f0000004c00))
capget(&(0x7f00000000c0)={0x19980330}, &(0x7f0000000100)={0x4, 0xfffffff7, 0x4, 0x8, 0x6, 0xffff})
r1 = socket$inet6_tcp(0xa, 0x1, 0x0)
r2 = dup(r1)
ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x9af139be227d9862}})
ioctl$TIOCMIWAIT(r2, 0x545c, 0x0)
r3 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000000)=ANY=[@ANYBLOB="500100001a00330600000000fddbdf25fe8000000000000000000000000000aafe8000000000000000000000000000aa000040002c6c80050000800000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="fe8000000000000000000000000000bb000000003200000000000000000000000000000000000001230300000000000001000080000000000000000000000000c0000000000000000040000000000000000000000000000000000000000000000800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000029bd7000033500000a000500000000000000000048000200656362286369706865725f6e756c6c290000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000005002100020000000800280000000000080027"], 0x150}, 0x1, 0x0, 0x0, 0x4000}, 0x200080d4)
r4 = openat(0xffffffffffffffff, &(0x7f00000000c0)='./file1\x00', 0x281c2, 0x0)
r5 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$inet6_int(r5, 0x29, 0x35, &(0x7f0000000000)=0x7907, 0x4)
bind$inet6(r5, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x7ff, @empty, 0x9}, 0x1c)
recvmmsg(r5, &(0x7f0000000240)=[{{0x0, 0x0, 0x0}, 0x8}], 0x1, 0x2, 0x0)
sendto$inet6(r2, 0x0, 0x0, 0x20004184, &(0x7f0000000200)={0xa, 0x4e20, 0x0, @local}, 0x1c)
r6 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$inet_tcp_int(r6, 0x6, 0x210000000013, &(0x7f0000000040)=0x100000001, 0x4)
setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r4, 0x6, 0x14, &(0x7f0000000140)=0x2, 0x4)
getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r6, 0x6, 0x15, 0x0, &(0x7f0000001880))
fcntl$setlease(r4, 0x400, 0x1)
fcntl$getflags(r4, 0x401)
ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_CLIENT(r4, 0xc04c5349, &(0x7f0000000040)={0x1, 0xfc, 0x8})
r7 = socket$inet6_tcp(0xa, 0x1, 0x0)
r8 = syz_open_dev$ttys(0xc, 0x2, 0x0)
ioctl$GIO_CMAP(r8, 0x4b70, &(0x7f0000000000))
syz_usb_connect(0x0, 0x24, &(0x7f00000001c0)=ANY=[@ANYBLOB="12010000b5b30a40450c056055b5010203010902120001000000000904", @ANYRES64=r7], 0x0)
ioctl$TIOCGPTLCK(r8, 0x5420, &(0x7f0000001d40))
getsockopt$inet6_tcp_buf(r7, 0x6, 0x1a, 0x0, &(0x7f00000003c0))

program crashed: possible deadlock in l2cap_chan_connect
bisect: the chunk can be dropped
bisect: split chunks (needed=true): <1>
bisect: split chunk #0 of len 1 into 2 parts
bisect: no way to further split the chunk
bisect: 2 programs left: 

executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) (async)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x1)
r3 = socket$netlink(0x10, 0x3, 0x0)
setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(r3, 0x10e, 0xc, &(0x7f0000000640)=0x7, 0x4) (async)
setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(r3, 0x10e, 0xc, &(0x7f0000000640)=0x7, 0x4)
sendmsg$netlink(r3, &(0x7f0000001080)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000300)={0x2c, 0x12, 0x1, 0x70bd26, 0x25dfdbfe, "", [@nested={0x10, 0x0, 0x0, 0x0, [@typed={0xc, 0xce, 0x0, 0x0, @u64}]}, @nested={0xc, 0x35, 0x0, 0x1, [@typed={0x8, 0x68, 0x0, 0x0, @u32=0x2da6}]}]}, 0x2c}], 0x1, 0x0, 0x0, 0x4000}, 0x4000800) (async)
sendmsg$netlink(r3, &(0x7f0000001080)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000300)={0x2c, 0x12, 0x1, 0x70bd26, 0x25dfdbfe, "", [@nested={0x10, 0x0, 0x0, 0x0, [@typed={0xc, 0xce, 0x0, 0x0, @u64}]}, @nested={0xc, 0x35, 0x0, 0x1, [@typed={0x8, 0x68, 0x0, 0x0, @u32=0x2da6}]}]}, 0x2c}], 0x1, 0x0, 0x0, 0x4000}, 0x4000800)
r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x1e9100, 0x0)
r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0)
syz_emit_vhci(&(0x7f0000001a40)=@HCI_EVENT_PKT={0x4, @hci_ev_auth_complete={{0x6, 0x3}, {0x0, 0xc9}}}, 0x6)
ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x2) (async)
r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x2)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r6, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000180)=[@text64={0x40, 0x0}], 0x1, 0x54, 0x0, 0x0) (async)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r6, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000180)=[@text64={0x40, 0x0}], 0x1, 0x54, 0x0, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000014000/0x18000)=nil, &(0x7f0000000100)=[@text64={0x40, 0x0}], 0x1, 0x4a, 0x0, 0x0)
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000100)={{0x14}, [@NFT_MSG_NEWTABLE={0x14, 0x0, 0xa, 0x101, 0x0, 0x0, {0x2}}], {0x14}}, 0x3c}}, 0x0)
syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@textreal={0x8, 0x0}], 0x1, 0x7a, 0x0, 0x0)
setns(0xc9, 0x0)
r7 = socket$nl_generic(0x10, 0x3, 0x10)
r8 = socket$nl_netfilter(0x10, 0x3, 0xc)
syz_genetlink_get_family_id$nl80211(&(0x7f0000000340), r7) (async)
r9 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000340), r7)
ioctl$sock_SIOCGIFINDEX_80211(r8, 0x8933, &(0x7f0000000380)={'wlan1\x00'}) (async)
ioctl$sock_SIOCGIFINDEX_80211(r8, 0x8933, &(0x7f0000000380)={'wlan1\x00', <r10=>0x0})
sendmsg$NL80211_CMD_DISCONNECT(r7, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000400)={&(0x7f00000003c0)={0x1c, r9, 0x1, 0x70bd2d, 0x25dfdbfb, {{}, {@val={0x8, 0x3, r10}, @void}}}, 0x1c}, 0x1, 0x0, 0x0, 0x8090}, 0x8814)
socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040))
ioctl$KVM_RUN(r2, 0xae80, 0x0)
executing program 2:
getrandom(&(0x7f0000000240)=""/286, 0xffffff9a, 0x0)
r0 = syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3)
connect$bt_rfcomm(r0, &(0x7f00000003c0)={0x1f, @none, 0x8}, 0xa)
getsockopt$sock_buf(r0, 0x1, 0x1c, 0x0, &(0x7f0000004c00))
capget(&(0x7f00000000c0)={0x19980330}, &(0x7f0000000100)={0x4, 0xfffffff7, 0x4, 0x8, 0x6, 0xffff})
r1 = socket$inet6_tcp(0xa, 0x1, 0x0)
r2 = dup(r1)
ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x9af139be227d9862}})
ioctl$TIOCMIWAIT(r2, 0x545c, 0x0)
r3 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000000)=ANY=[@ANYBLOB="500100001a00330600000000fddbdf25fe8000000000000000000000000000aafe8000000000000000000000000000aa000040002c6c80050000800000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="fe8000000000000000000000000000bb000000003200000000000000000000000000000000000001230300000000000001000080000000000000000000000000c0000000000000000040000000000000000000000000000000000000000000000800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000029bd7000033500000a000500000000000000000048000200656362286369706865725f6e756c6c290000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000005002100020000000800280000000000080027"], 0x150}, 0x1, 0x0, 0x0, 0x4000}, 0x200080d4)
r4 = openat(0xffffffffffffffff, &(0x7f00000000c0)='./file1\x00', 0x281c2, 0x0)
r5 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$inet6_int(r5, 0x29, 0x35, &(0x7f0000000000)=0x7907, 0x4)
bind$inet6(r5, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x7ff, @empty, 0x9}, 0x1c)
recvmmsg(r5, &(0x7f0000000240)=[{{0x0, 0x0, 0x0}, 0x8}], 0x1, 0x2, 0x0)
sendto$inet6(r2, 0x0, 0x0, 0x20004184, &(0x7f0000000200)={0xa, 0x4e20, 0x0, @local}, 0x1c)
r6 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$inet_tcp_int(r6, 0x6, 0x210000000013, &(0x7f0000000040)=0x100000001, 0x4)
setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r4, 0x6, 0x14, &(0x7f0000000140)=0x2, 0x4)
getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r6, 0x6, 0x15, 0x0, &(0x7f0000001880))
fcntl$setlease(r4, 0x400, 0x1)
fcntl$getflags(r4, 0x401)
ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_CLIENT(r4, 0xc04c5349, &(0x7f0000000040)={0x1, 0xfc, 0x8})
r7 = socket$inet6_tcp(0xa, 0x1, 0x0)
r8 = syz_open_dev$ttys(0xc, 0x2, 0x0)
ioctl$GIO_CMAP(r8, 0x4b70, &(0x7f0000000000))
syz_usb_connect(0x0, 0x24, &(0x7f00000001c0)=ANY=[@ANYBLOB="12010000b5b30a40450c056055b5010203010902120001000000000904", @ANYRES64=r7], 0x0)
ioctl$TIOCGPTLCK(r8, 0x5420, &(0x7f0000001d40))
getsockopt$inet6_tcp_buf(r7, 0x6, 0x1a, 0x0, &(0x7f00000003c0))


bisect: trying to concatenate
bisect: concatenate 2 entries
minimizing program #0 before concatenation
testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [28, 30]
detailed listing:
executing program 0:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) (async)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x1)
r3 = socket$netlink(0x10, 0x3, 0x0)
setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(r3, 0x10e, 0xc, &(0x7f0000000640)=0x7, 0x4) (async)
setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(r3, 0x10e, 0xc, &(0x7f0000000640)=0x7, 0x4)
sendmsg$netlink(r3, &(0x7f0000001080)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000300)={0x2c, 0x12, 0x1, 0x70bd26, 0x25dfdbfe, "", [@nested={0x10, 0x0, 0x0, 0x0, [@typed={0xc, 0xce, 0x0, 0x0, @u64}]}, @nested={0xc, 0x35, 0x0, 0x1, [@typed={0x8, 0x68, 0x0, 0x0, @u32=0x2da6}]}]}, 0x2c}], 0x1, 0x0, 0x0, 0x4000}, 0x4000800) (async)
sendmsg$netlink(r3, &(0x7f0000001080)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000300)={0x2c, 0x12, 0x1, 0x70bd26, 0x25dfdbfe, "", [@nested={0x10, 0x0, 0x0, 0x0, [@typed={0xc, 0xce, 0x0, 0x0, @u64}]}, @nested={0xc, 0x35, 0x0, 0x1, [@typed={0x8, 0x68, 0x0, 0x0, @u32=0x2da6}]}]}, 0x2c}], 0x1, 0x0, 0x0, 0x4000}, 0x4000800)
r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x1e9100, 0x0)
r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0)
syz_emit_vhci(&(0x7f0000001a40)=@HCI_EVENT_PKT={0x4, @hci_ev_auth_complete={{0x6, 0x3}, {0x0, 0xc9}}}, 0x6)
ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x2) (async)
r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x2)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r6, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000180)=[@text64={0x40, 0x0}], 0x1, 0x54, 0x0, 0x0) (async)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r6, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000180)=[@text64={0x40, 0x0}], 0x1, 0x54, 0x0, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000014000/0x18000)=nil, &(0x7f0000000100)=[@text64={0x40, 0x0}], 0x1, 0x4a, 0x0, 0x0)
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000100)={{0x14}, [@NFT_MSG_NEWTABLE={0x14, 0x0, 0xa, 0x101, 0x0, 0x0, {0x2}}], {0x14}}, 0x3c}}, 0x0)
syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@textreal={0x8, 0x0}], 0x1, 0x7a, 0x0, 0x0)
setns(0xc9, 0x0)
r7 = socket$nl_generic(0x10, 0x3, 0x10)
r8 = socket$nl_netfilter(0x10, 0x3, 0xc)
syz_genetlink_get_family_id$nl80211(&(0x7f0000000340), r7) (async)
r9 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000340), r7)
ioctl$sock_SIOCGIFINDEX_80211(r8, 0x8933, &(0x7f0000000380)={'wlan1\x00'}) (async)
ioctl$sock_SIOCGIFINDEX_80211(r8, 0x8933, &(0x7f0000000380)={'wlan1\x00', <r10=>0x0})
sendmsg$NL80211_CMD_DISCONNECT(r7, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000400)={&(0x7f00000003c0)={0x1c, r9, 0x1, 0x70bd2d, 0x25dfdbfb, {{}, {@val={0x8, 0x3, r10}, @void}}}, 0x1c}, 0x1, 0x0, 0x0, 0x8090}, 0x8814)
socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040))
executing program 2:
getrandom(&(0x7f0000000240)=""/286, 0xffffff9a, 0x0)
r0 = syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3)
connect$bt_rfcomm(r0, &(0x7f00000003c0)={0x1f, @none, 0x8}, 0xa)
getsockopt$sock_buf(r0, 0x1, 0x1c, 0x0, &(0x7f0000004c00))
capget(&(0x7f00000000c0)={0x19980330}, &(0x7f0000000100)={0x4, 0xfffffff7, 0x4, 0x8, 0x6, 0xffff})
r1 = socket$inet6_tcp(0xa, 0x1, 0x0)
r2 = dup(r1)
ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x9af139be227d9862}})
ioctl$TIOCMIWAIT(r2, 0x545c, 0x0)
r3 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000000)=ANY=[@ANYBLOB="500100001a00330600000000fddbdf25fe8000000000000000000000000000aafe8000000000000000000000000000aa000040002c6c80050000800000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="fe8000000000000000000000000000bb000000003200000000000000000000000000000000000001230300000000000001000080000000000000000000000000c0000000000000000040000000000000000000000000000000000000000000000800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000029bd7000033500000a000500000000000000000048000200656362286369706865725f6e756c6c290000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000005002100020000000800280000000000080027"], 0x150}, 0x1, 0x0, 0x0, 0x4000}, 0x200080d4)
r4 = openat(0xffffffffffffffff, &(0x7f00000000c0)='./file1\x00', 0x281c2, 0x0)
r5 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$inet6_int(r5, 0x29, 0x35, &(0x7f0000000000)=0x7907, 0x4)
bind$inet6(r5, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x7ff, @empty, 0x9}, 0x1c)
recvmmsg(r5, &(0x7f0000000240)=[{{0x0, 0x0, 0x0}, 0x8}], 0x1, 0x2, 0x0)
sendto$inet6(r2, 0x0, 0x0, 0x20004184, &(0x7f0000000200)={0xa, 0x4e20, 0x0, @local}, 0x1c)
r6 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$inet_tcp_int(r6, 0x6, 0x210000000013, &(0x7f0000000040)=0x100000001, 0x4)
setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r4, 0x6, 0x14, &(0x7f0000000140)=0x2, 0x4)
getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r6, 0x6, 0x15, 0x0, &(0x7f0000001880))
fcntl$setlease(r4, 0x400, 0x1)
fcntl$getflags(r4, 0x401)
ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_CLIENT(r4, 0xc04c5349, &(0x7f0000000040)={0x1, 0xfc, 0x8})
r7 = socket$inet6_tcp(0xa, 0x1, 0x0)
r8 = syz_open_dev$ttys(0xc, 0x2, 0x0)
ioctl$GIO_CMAP(r8, 0x4b70, &(0x7f0000000000))
syz_usb_connect(0x0, 0x24, &(0x7f00000001c0)=ANY=[@ANYBLOB="12010000b5b30a40450c056055b5010203010902120001000000000904", @ANYRES64=r7], 0x0)
ioctl$TIOCGPTLCK(r8, 0x5420, &(0x7f0000001d40))
getsockopt$inet6_tcp_buf(r7, 0x6, 0x1a, 0x0, &(0x7f00000003c0))

program crashed: possible deadlock in rfcomm_security_cfm
testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [27, 30]
detailed listing:
executing program 0:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) (async)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x1)
r3 = socket$netlink(0x10, 0x3, 0x0)
setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(r3, 0x10e, 0xc, &(0x7f0000000640)=0x7, 0x4) (async)
setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(r3, 0x10e, 0xc, &(0x7f0000000640)=0x7, 0x4)
sendmsg$netlink(r3, &(0x7f0000001080)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000300)={0x2c, 0x12, 0x1, 0x70bd26, 0x25dfdbfe, "", [@nested={0x10, 0x0, 0x0, 0x0, [@typed={0xc, 0xce, 0x0, 0x0, @u64}]}, @nested={0xc, 0x35, 0x0, 0x1, [@typed={0x8, 0x68, 0x0, 0x0, @u32=0x2da6}]}]}, 0x2c}], 0x1, 0x0, 0x0, 0x4000}, 0x4000800) (async)
sendmsg$netlink(r3, &(0x7f0000001080)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000300)={0x2c, 0x12, 0x1, 0x70bd26, 0x25dfdbfe, "", [@nested={0x10, 0x0, 0x0, 0x0, [@typed={0xc, 0xce, 0x0, 0x0, @u64}]}, @nested={0xc, 0x35, 0x0, 0x1, [@typed={0x8, 0x68, 0x0, 0x0, @u32=0x2da6}]}]}, 0x2c}], 0x1, 0x0, 0x0, 0x4000}, 0x4000800)
r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x1e9100, 0x0)
r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0)
syz_emit_vhci(&(0x7f0000001a40)=@HCI_EVENT_PKT={0x4, @hci_ev_auth_complete={{0x6, 0x3}, {0x0, 0xc9}}}, 0x6)
ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x2) (async)
r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x2)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r6, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000180)=[@text64={0x40, 0x0}], 0x1, 0x54, 0x0, 0x0) (async)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r6, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000180)=[@text64={0x40, 0x0}], 0x1, 0x54, 0x0, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000014000/0x18000)=nil, &(0x7f0000000100)=[@text64={0x40, 0x0}], 0x1, 0x4a, 0x0, 0x0)
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000100)={{0x14}, [@NFT_MSG_NEWTABLE={0x14, 0x0, 0xa, 0x101, 0x0, 0x0, {0x2}}], {0x14}}, 0x3c}}, 0x0)
syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@textreal={0x8, 0x0}], 0x1, 0x7a, 0x0, 0x0)
setns(0xc9, 0x0)
r7 = socket$nl_generic(0x10, 0x3, 0x10)
r8 = socket$nl_netfilter(0x10, 0x3, 0xc)
syz_genetlink_get_family_id$nl80211(&(0x7f0000000340), r7) (async)
r9 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000340), r7)
ioctl$sock_SIOCGIFINDEX_80211(r8, 0x8933, &(0x7f0000000380)={'wlan1\x00'}) (async)
ioctl$sock_SIOCGIFINDEX_80211(r8, 0x8933, &(0x7f0000000380)={'wlan1\x00', <r10=>0x0})
sendmsg$NL80211_CMD_DISCONNECT(r7, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000400)={&(0x7f00000003c0)={0x1c, r9, 0x1, 0x70bd2d, 0x25dfdbfb, {{}, {@val={0x8, 0x3, r10}, @void}}}, 0x1c}, 0x1, 0x0, 0x0, 0x8090}, 0x8814)
executing program 2:
getrandom(&(0x7f0000000240)=""/286, 0xffffff9a, 0x0)
r0 = syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3)
connect$bt_rfcomm(r0, &(0x7f00000003c0)={0x1f, @none, 0x8}, 0xa)
getsockopt$sock_buf(r0, 0x1, 0x1c, 0x0, &(0x7f0000004c00))
capget(&(0x7f00000000c0)={0x19980330}, &(0x7f0000000100)={0x4, 0xfffffff7, 0x4, 0x8, 0x6, 0xffff})
r1 = socket$inet6_tcp(0xa, 0x1, 0x0)
r2 = dup(r1)
ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x9af139be227d9862}})
ioctl$TIOCMIWAIT(r2, 0x545c, 0x0)
r3 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000000)=ANY=[@ANYBLOB="500100001a00330600000000fddbdf25fe8000000000000000000000000000aafe8000000000000000000000000000aa000040002c6c80050000800000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="fe8000000000000000000000000000bb000000003200000000000000000000000000000000000001230300000000000001000080000000000000000000000000c0000000000000000040000000000000000000000000000000000000000000000800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000029bd7000033500000a000500000000000000000048000200656362286369706865725f6e756c6c290000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000005002100020000000800280000000000080027"], 0x150}, 0x1, 0x0, 0x0, 0x4000}, 0x200080d4)
r4 = openat(0xffffffffffffffff, &(0x7f00000000c0)='./file1\x00', 0x281c2, 0x0)
r5 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$inet6_int(r5, 0x29, 0x35, &(0x7f0000000000)=0x7907, 0x4)
bind$inet6(r5, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x7ff, @empty, 0x9}, 0x1c)
recvmmsg(r5, &(0x7f0000000240)=[{{0x0, 0x0, 0x0}, 0x8}], 0x1, 0x2, 0x0)
sendto$inet6(r2, 0x0, 0x0, 0x20004184, &(0x7f0000000200)={0xa, 0x4e20, 0x0, @local}, 0x1c)
r6 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$inet_tcp_int(r6, 0x6, 0x210000000013, &(0x7f0000000040)=0x100000001, 0x4)
setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r4, 0x6, 0x14, &(0x7f0000000140)=0x2, 0x4)
getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r6, 0x6, 0x15, 0x0, &(0x7f0000001880))
fcntl$setlease(r4, 0x400, 0x1)
fcntl$getflags(r4, 0x401)
ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_CLIENT(r4, 0xc04c5349, &(0x7f0000000040)={0x1, 0xfc, 0x8})
r7 = socket$inet6_tcp(0xa, 0x1, 0x0)
r8 = syz_open_dev$ttys(0xc, 0x2, 0x0)
ioctl$GIO_CMAP(r8, 0x4b70, &(0x7f0000000000))
syz_usb_connect(0x0, 0x24, &(0x7f00000001c0)=ANY=[@ANYBLOB="12010000b5b30a40450c056055b5010203010902120001000000000904", @ANYRES64=r7], 0x0)
ioctl$TIOCGPTLCK(r8, 0x5420, &(0x7f0000001d40))
getsockopt$inet6_tcp_buf(r7, 0x6, 0x1a, 0x0, &(0x7f00000003c0))

program crashed: possible deadlock in rfcomm_security_cfm
testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [26, 30]
detailed listing:
executing program 0:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) (async)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x1)
r3 = socket$netlink(0x10, 0x3, 0x0)
setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(r3, 0x10e, 0xc, &(0x7f0000000640)=0x7, 0x4) (async)
setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(r3, 0x10e, 0xc, &(0x7f0000000640)=0x7, 0x4)
sendmsg$netlink(r3, &(0x7f0000001080)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000300)={0x2c, 0x12, 0x1, 0x70bd26, 0x25dfdbfe, "", [@nested={0x10, 0x0, 0x0, 0x0, [@typed={0xc, 0xce, 0x0, 0x0, @u64}]}, @nested={0xc, 0x35, 0x0, 0x1, [@typed={0x8, 0x68, 0x0, 0x0, @u32=0x2da6}]}]}, 0x2c}], 0x1, 0x0, 0x0, 0x4000}, 0x4000800) (async)
sendmsg$netlink(r3, &(0x7f0000001080)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000300)={0x2c, 0x12, 0x1, 0x70bd26, 0x25dfdbfe, "", [@nested={0x10, 0x0, 0x0, 0x0, [@typed={0xc, 0xce, 0x0, 0x0, @u64}]}, @nested={0xc, 0x35, 0x0, 0x1, [@typed={0x8, 0x68, 0x0, 0x0, @u32=0x2da6}]}]}, 0x2c}], 0x1, 0x0, 0x0, 0x4000}, 0x4000800)
r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x1e9100, 0x0)
r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0)
syz_emit_vhci(&(0x7f0000001a40)=@HCI_EVENT_PKT={0x4, @hci_ev_auth_complete={{0x6, 0x3}, {0x0, 0xc9}}}, 0x6)
ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x2) (async)
r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x2)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r6, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000180)=[@text64={0x40, 0x0}], 0x1, 0x54, 0x0, 0x0) (async)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r6, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000180)=[@text64={0x40, 0x0}], 0x1, 0x54, 0x0, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000014000/0x18000)=nil, &(0x7f0000000100)=[@text64={0x40, 0x0}], 0x1, 0x4a, 0x0, 0x0)
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000100)={{0x14}, [@NFT_MSG_NEWTABLE={0x14, 0x0, 0xa, 0x101, 0x0, 0x0, {0x2}}], {0x14}}, 0x3c}}, 0x0)
syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@textreal={0x8, 0x0}], 0x1, 0x7a, 0x0, 0x0)
setns(0xc9, 0x0)
r7 = socket$nl_generic(0x10, 0x3, 0x10)
r8 = socket$nl_netfilter(0x10, 0x3, 0xc)
syz_genetlink_get_family_id$nl80211(&(0x7f0000000340), r7) (async)
syz_genetlink_get_family_id$nl80211(&(0x7f0000000340), r7)
ioctl$sock_SIOCGIFINDEX_80211(r8, 0x8933, &(0x7f0000000380)={'wlan1\x00'}) (async)
ioctl$sock_SIOCGIFINDEX_80211(r8, 0x8933, &(0x7f0000000380)={'wlan1\x00'})
executing program 2:
getrandom(&(0x7f0000000240)=""/286, 0xffffff9a, 0x0)
r0 = syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3)
connect$bt_rfcomm(r0, &(0x7f00000003c0)={0x1f, @none, 0x8}, 0xa)
getsockopt$sock_buf(r0, 0x1, 0x1c, 0x0, &(0x7f0000004c00))
capget(&(0x7f00000000c0)={0x19980330}, &(0x7f0000000100)={0x4, 0xfffffff7, 0x4, 0x8, 0x6, 0xffff})
r1 = socket$inet6_tcp(0xa, 0x1, 0x0)
r2 = dup(r1)
ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x9af139be227d9862}})
ioctl$TIOCMIWAIT(r2, 0x545c, 0x0)
r3 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000000)=ANY=[@ANYBLOB="500100001a00330600000000fddbdf25fe8000000000000000000000000000aafe8000000000000000000000000000aa000040002c6c80050000800000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="fe8000000000000000000000000000bb000000003200000000000000000000000000000000000001230300000000000001000080000000000000000000000000c0000000000000000040000000000000000000000000000000000000000000000800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000029bd7000033500000a000500000000000000000048000200656362286369706865725f6e756c6c290000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000005002100020000000800280000000000080027"], 0x150}, 0x1, 0x0, 0x0, 0x4000}, 0x200080d4)
r4 = openat(0xffffffffffffffff, &(0x7f00000000c0)='./file1\x00', 0x281c2, 0x0)
r5 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$inet6_int(r5, 0x29, 0x35, &(0x7f0000000000)=0x7907, 0x4)
bind$inet6(r5, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x7ff, @empty, 0x9}, 0x1c)
recvmmsg(r5, &(0x7f0000000240)=[{{0x0, 0x0, 0x0}, 0x8}], 0x1, 0x2, 0x0)
sendto$inet6(r2, 0x0, 0x0, 0x20004184, &(0x7f0000000200)={0xa, 0x4e20, 0x0, @local}, 0x1c)
r6 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$inet_tcp_int(r6, 0x6, 0x210000000013, &(0x7f0000000040)=0x100000001, 0x4)
setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r4, 0x6, 0x14, &(0x7f0000000140)=0x2, 0x4)
getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r6, 0x6, 0x15, 0x0, &(0x7f0000001880))
fcntl$setlease(r4, 0x400, 0x1)
fcntl$getflags(r4, 0x401)
ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_CLIENT(r4, 0xc04c5349, &(0x7f0000000040)={0x1, 0xfc, 0x8})
r7 = socket$inet6_tcp(0xa, 0x1, 0x0)
r8 = syz_open_dev$ttys(0xc, 0x2, 0x0)
ioctl$GIO_CMAP(r8, 0x4b70, &(0x7f0000000000))
syz_usb_connect(0x0, 0x24, &(0x7f00000001c0)=ANY=[@ANYBLOB="12010000b5b30a40450c056055b5010203010902120001000000000904", @ANYRES64=r7], 0x0)
ioctl$TIOCGPTLCK(r8, 0x5420, &(0x7f0000001d40))
getsockopt$inet6_tcp_buf(r7, 0x6, 0x1a, 0x0, &(0x7f00000003c0))

program crashed: possible deadlock in rfcomm_security_cfm
testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [25, 30]
detailed listing:
executing program 0:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) (async)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x1)
r3 = socket$netlink(0x10, 0x3, 0x0)
setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(r3, 0x10e, 0xc, &(0x7f0000000640)=0x7, 0x4) (async)
setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(r3, 0x10e, 0xc, &(0x7f0000000640)=0x7, 0x4)
sendmsg$netlink(r3, &(0x7f0000001080)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000300)={0x2c, 0x12, 0x1, 0x70bd26, 0x25dfdbfe, "", [@nested={0x10, 0x0, 0x0, 0x0, [@typed={0xc, 0xce, 0x0, 0x0, @u64}]}, @nested={0xc, 0x35, 0x0, 0x1, [@typed={0x8, 0x68, 0x0, 0x0, @u32=0x2da6}]}]}, 0x2c}], 0x1, 0x0, 0x0, 0x4000}, 0x4000800) (async)
sendmsg$netlink(r3, &(0x7f0000001080)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000300)={0x2c, 0x12, 0x1, 0x70bd26, 0x25dfdbfe, "", [@nested={0x10, 0x0, 0x0, 0x0, [@typed={0xc, 0xce, 0x0, 0x0, @u64}]}, @nested={0xc, 0x35, 0x0, 0x1, [@typed={0x8, 0x68, 0x0, 0x0, @u32=0x2da6}]}]}, 0x2c}], 0x1, 0x0, 0x0, 0x4000}, 0x4000800)
r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x1e9100, 0x0)
r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0)
syz_emit_vhci(&(0x7f0000001a40)=@HCI_EVENT_PKT={0x4, @hci_ev_auth_complete={{0x6, 0x3}, {0x0, 0xc9}}}, 0x6)
ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x2) (async)
r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x2)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r6, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000180)=[@text64={0x40, 0x0}], 0x1, 0x54, 0x0, 0x0) (async)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r6, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000180)=[@text64={0x40, 0x0}], 0x1, 0x54, 0x0, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000014000/0x18000)=nil, &(0x7f0000000100)=[@text64={0x40, 0x0}], 0x1, 0x4a, 0x0, 0x0)
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000100)={{0x14}, [@NFT_MSG_NEWTABLE={0x14, 0x0, 0xa, 0x101, 0x0, 0x0, {0x2}}], {0x14}}, 0x3c}}, 0x0)
syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@textreal={0x8, 0x0}], 0x1, 0x7a, 0x0, 0x0)
setns(0xc9, 0x0)
r7 = socket$nl_generic(0x10, 0x3, 0x10)
r8 = socket$nl_netfilter(0x10, 0x3, 0xc)
syz_genetlink_get_family_id$nl80211(&(0x7f0000000340), r7) (async)
syz_genetlink_get_family_id$nl80211(&(0x7f0000000340), r7)
ioctl$sock_SIOCGIFINDEX_80211(r8, 0x8933, &(0x7f0000000380)={'wlan1\x00'}) (async)
executing program 2:
getrandom(&(0x7f0000000240)=""/286, 0xffffff9a, 0x0)
r0 = syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3)
connect$bt_rfcomm(r0, &(0x7f00000003c0)={0x1f, @none, 0x8}, 0xa)
getsockopt$sock_buf(r0, 0x1, 0x1c, 0x0, &(0x7f0000004c00))
capget(&(0x7f00000000c0)={0x19980330}, &(0x7f0000000100)={0x4, 0xfffffff7, 0x4, 0x8, 0x6, 0xffff})
r1 = socket$inet6_tcp(0xa, 0x1, 0x0)
r2 = dup(r1)
ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x9af139be227d9862}})
ioctl$TIOCMIWAIT(r2, 0x545c, 0x0)
r3 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000000)=ANY=[@ANYBLOB="500100001a00330600000000fddbdf25fe8000000000000000000000000000aafe8000000000000000000000000000aa000040002c6c80050000800000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="fe8000000000000000000000000000bb000000003200000000000000000000000000000000000001230300000000000001000080000000000000000000000000c0000000000000000040000000000000000000000000000000000000000000000800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000029bd7000033500000a000500000000000000000048000200656362286369706865725f6e756c6c290000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000005002100020000000800280000000000080027"], 0x150}, 0x1, 0x0, 0x0, 0x4000}, 0x200080d4)
r4 = openat(0xffffffffffffffff, &(0x7f00000000c0)='./file1\x00', 0x281c2, 0x0)
r5 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$inet6_int(r5, 0x29, 0x35, &(0x7f0000000000)=0x7907, 0x4)
bind$inet6(r5, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x7ff, @empty, 0x9}, 0x1c)
recvmmsg(r5, &(0x7f0000000240)=[{{0x0, 0x0, 0x0}, 0x8}], 0x1, 0x2, 0x0)
sendto$inet6(r2, 0x0, 0x0, 0x20004184, &(0x7f0000000200)={0xa, 0x4e20, 0x0, @local}, 0x1c)
r6 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$inet_tcp_int(r6, 0x6, 0x210000000013, &(0x7f0000000040)=0x100000001, 0x4)
setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r4, 0x6, 0x14, &(0x7f0000000140)=0x2, 0x4)
getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r6, 0x6, 0x15, 0x0, &(0x7f0000001880))
fcntl$setlease(r4, 0x400, 0x1)
fcntl$getflags(r4, 0x401)
ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_CLIENT(r4, 0xc04c5349, &(0x7f0000000040)={0x1, 0xfc, 0x8})
r7 = socket$inet6_tcp(0xa, 0x1, 0x0)
r8 = syz_open_dev$ttys(0xc, 0x2, 0x0)
ioctl$GIO_CMAP(r8, 0x4b70, &(0x7f0000000000))
syz_usb_connect(0x0, 0x24, &(0x7f00000001c0)=ANY=[@ANYBLOB="12010000b5b30a40450c056055b5010203010902120001000000000904", @ANYRES64=r7], 0x0)
ioctl$TIOCGPTLCK(r8, 0x5420, &(0x7f0000001d40))
getsockopt$inet6_tcp_buf(r7, 0x6, 0x1a, 0x0, &(0x7f00000003c0))

program crashed: possible deadlock in rfcomm_security_cfm
testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [24, 30]
detailed listing:
executing program 0:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) (async)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x1)
r3 = socket$netlink(0x10, 0x3, 0x0)
setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(r3, 0x10e, 0xc, &(0x7f0000000640)=0x7, 0x4) (async)
setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(r3, 0x10e, 0xc, &(0x7f0000000640)=0x7, 0x4)
sendmsg$netlink(r3, &(0x7f0000001080)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000300)={0x2c, 0x12, 0x1, 0x70bd26, 0x25dfdbfe, "", [@nested={0x10, 0x0, 0x0, 0x0, [@typed={0xc, 0xce, 0x0, 0x0, @u64}]}, @nested={0xc, 0x35, 0x0, 0x1, [@typed={0x8, 0x68, 0x0, 0x0, @u32=0x2da6}]}]}, 0x2c}], 0x1, 0x0, 0x0, 0x4000}, 0x4000800) (async)
sendmsg$netlink(r3, &(0x7f0000001080)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000300)={0x2c, 0x12, 0x1, 0x70bd26, 0x25dfdbfe, "", [@nested={0x10, 0x0, 0x0, 0x0, [@typed={0xc, 0xce, 0x0, 0x0, @u64}]}, @nested={0xc, 0x35, 0x0, 0x1, [@typed={0x8, 0x68, 0x0, 0x0, @u32=0x2da6}]}]}, 0x2c}], 0x1, 0x0, 0x0, 0x4000}, 0x4000800)
r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x1e9100, 0x0)
r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0)
syz_emit_vhci(&(0x7f0000001a40)=@HCI_EVENT_PKT={0x4, @hci_ev_auth_complete={{0x6, 0x3}, {0x0, 0xc9}}}, 0x6)
ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x2) (async)
r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x2)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r6, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000180)=[@text64={0x40, 0x0}], 0x1, 0x54, 0x0, 0x0) (async)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r6, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000180)=[@text64={0x40, 0x0}], 0x1, 0x54, 0x0, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000014000/0x18000)=nil, &(0x7f0000000100)=[@text64={0x40, 0x0}], 0x1, 0x4a, 0x0, 0x0)
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000100)={{0x14}, [@NFT_MSG_NEWTABLE={0x14, 0x0, 0xa, 0x101, 0x0, 0x0, {0x2}}], {0x14}}, 0x3c}}, 0x0)
syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@textreal={0x8, 0x0}], 0x1, 0x7a, 0x0, 0x0)
setns(0xc9, 0x0)
r7 = socket$nl_generic(0x10, 0x3, 0x10)
socket$nl_netfilter(0x10, 0x3, 0xc)
syz_genetlink_get_family_id$nl80211(&(0x7f0000000340), r7) (async)
syz_genetlink_get_family_id$nl80211(&(0x7f0000000340), r7)
executing program 2:
getrandom(&(0x7f0000000240)=""/286, 0xffffff9a, 0x0)
r0 = syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3)
connect$bt_rfcomm(r0, &(0x7f00000003c0)={0x1f, @none, 0x8}, 0xa)
getsockopt$sock_buf(r0, 0x1, 0x1c, 0x0, &(0x7f0000004c00))
capget(&(0x7f00000000c0)={0x19980330}, &(0x7f0000000100)={0x4, 0xfffffff7, 0x4, 0x8, 0x6, 0xffff})
r1 = socket$inet6_tcp(0xa, 0x1, 0x0)
r2 = dup(r1)
ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x9af139be227d9862}})
ioctl$TIOCMIWAIT(r2, 0x545c, 0x0)
r3 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000000)=ANY=[@ANYBLOB="500100001a00330600000000fddbdf25fe8000000000000000000000000000aafe8000000000000000000000000000aa000040002c6c80050000800000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="fe8000000000000000000000000000bb000000003200000000000000000000000000000000000001230300000000000001000080000000000000000000000000c0000000000000000040000000000000000000000000000000000000000000000800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000029bd7000033500000a000500000000000000000048000200656362286369706865725f6e756c6c290000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000005002100020000000800280000000000080027"], 0x150}, 0x1, 0x0, 0x0, 0x4000}, 0x200080d4)
r4 = openat(0xffffffffffffffff, &(0x7f00000000c0)='./file1\x00', 0x281c2, 0x0)
r5 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$inet6_int(r5, 0x29, 0x35, &(0x7f0000000000)=0x7907, 0x4)
bind$inet6(r5, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x7ff, @empty, 0x9}, 0x1c)
recvmmsg(r5, &(0x7f0000000240)=[{{0x0, 0x0, 0x0}, 0x8}], 0x1, 0x2, 0x0)
sendto$inet6(r2, 0x0, 0x0, 0x20004184, &(0x7f0000000200)={0xa, 0x4e20, 0x0, @local}, 0x1c)
r6 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$inet_tcp_int(r6, 0x6, 0x210000000013, &(0x7f0000000040)=0x100000001, 0x4)
setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r4, 0x6, 0x14, &(0x7f0000000140)=0x2, 0x4)
getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r6, 0x6, 0x15, 0x0, &(0x7f0000001880))
fcntl$setlease(r4, 0x400, 0x1)
fcntl$getflags(r4, 0x401)
ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_CLIENT(r4, 0xc04c5349, &(0x7f0000000040)={0x1, 0xfc, 0x8})
r7 = socket$inet6_tcp(0xa, 0x1, 0x0)
r8 = syz_open_dev$ttys(0xc, 0x2, 0x0)
ioctl$GIO_CMAP(r8, 0x4b70, &(0x7f0000000000))
syz_usb_connect(0x0, 0x24, &(0x7f00000001c0)=ANY=[@ANYBLOB="12010000b5b30a40450c056055b5010203010902120001000000000904", @ANYRES64=r7], 0x0)
ioctl$TIOCGPTLCK(r8, 0x5420, &(0x7f0000001d40))
getsockopt$inet6_tcp_buf(r7, 0x6, 0x1a, 0x0, &(0x7f00000003c0))

program crashed: possible deadlock in l2cap_chan_connect
testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [23, 30]
detailed listing:
executing program 0:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) (async)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x1)
r3 = socket$netlink(0x10, 0x3, 0x0)
setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(r3, 0x10e, 0xc, &(0x7f0000000640)=0x7, 0x4) (async)
setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(r3, 0x10e, 0xc, &(0x7f0000000640)=0x7, 0x4)
sendmsg$netlink(r3, &(0x7f0000001080)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000300)={0x2c, 0x12, 0x1, 0x70bd26, 0x25dfdbfe, "", [@nested={0x10, 0x0, 0x0, 0x0, [@typed={0xc, 0xce, 0x0, 0x0, @u64}]}, @nested={0xc, 0x35, 0x0, 0x1, [@typed={0x8, 0x68, 0x0, 0x0, @u32=0x2da6}]}]}, 0x2c}], 0x1, 0x0, 0x0, 0x4000}, 0x4000800) (async)
sendmsg$netlink(r3, &(0x7f0000001080)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000300)={0x2c, 0x12, 0x1, 0x70bd26, 0x25dfdbfe, "", [@nested={0x10, 0x0, 0x0, 0x0, [@typed={0xc, 0xce, 0x0, 0x0, @u64}]}, @nested={0xc, 0x35, 0x0, 0x1, [@typed={0x8, 0x68, 0x0, 0x0, @u32=0x2da6}]}]}, 0x2c}], 0x1, 0x0, 0x0, 0x4000}, 0x4000800)
r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x1e9100, 0x0)
r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0)
syz_emit_vhci(&(0x7f0000001a40)=@HCI_EVENT_PKT={0x4, @hci_ev_auth_complete={{0x6, 0x3}, {0x0, 0xc9}}}, 0x6)
ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x2) (async)
r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x2)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r6, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000180)=[@text64={0x40, 0x0}], 0x1, 0x54, 0x0, 0x0) (async)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r6, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000180)=[@text64={0x40, 0x0}], 0x1, 0x54, 0x0, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000014000/0x18000)=nil, &(0x7f0000000100)=[@text64={0x40, 0x0}], 0x1, 0x4a, 0x0, 0x0)
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000100)={{0x14}, [@NFT_MSG_NEWTABLE={0x14, 0x0, 0xa, 0x101, 0x0, 0x0, {0x2}}], {0x14}}, 0x3c}}, 0x0)
syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@textreal={0x8, 0x0}], 0x1, 0x7a, 0x0, 0x0)
setns(0xc9, 0x0)
r7 = socket$nl_generic(0x10, 0x3, 0x10)
socket$nl_netfilter(0x10, 0x3, 0xc)
syz_genetlink_get_family_id$nl80211(&(0x7f0000000340), r7) (async)
executing program 2:
getrandom(&(0x7f0000000240)=""/286, 0xffffff9a, 0x0)
r0 = syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3)
connect$bt_rfcomm(r0, &(0x7f00000003c0)={0x1f, @none, 0x8}, 0xa)
getsockopt$sock_buf(r0, 0x1, 0x1c, 0x0, &(0x7f0000004c00))
capget(&(0x7f00000000c0)={0x19980330}, &(0x7f0000000100)={0x4, 0xfffffff7, 0x4, 0x8, 0x6, 0xffff})
r1 = socket$inet6_tcp(0xa, 0x1, 0x0)
r2 = dup(r1)
ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x9af139be227d9862}})
ioctl$TIOCMIWAIT(r2, 0x545c, 0x0)
r3 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000000)=ANY=[@ANYBLOB="500100001a00330600000000fddbdf25fe8000000000000000000000000000aafe8000000000000000000000000000aa000040002c6c80050000800000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="fe8000000000000000000000000000bb000000003200000000000000000000000000000000000001230300000000000001000080000000000000000000000000c0000000000000000040000000000000000000000000000000000000000000000800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000029bd7000033500000a000500000000000000000048000200656362286369706865725f6e756c6c290000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000005002100020000000800280000000000080027"], 0x150}, 0x1, 0x0, 0x0, 0x4000}, 0x200080d4)
r4 = openat(0xffffffffffffffff, &(0x7f00000000c0)='./file1\x00', 0x281c2, 0x0)
r5 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$inet6_int(r5, 0x29, 0x35, &(0x7f0000000000)=0x7907, 0x4)
bind$inet6(r5, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x7ff, @empty, 0x9}, 0x1c)
recvmmsg(r5, &(0x7f0000000240)=[{{0x0, 0x0, 0x0}, 0x8}], 0x1, 0x2, 0x0)
sendto$inet6(r2, 0x0, 0x0, 0x20004184, &(0x7f0000000200)={0xa, 0x4e20, 0x0, @local}, 0x1c)
r6 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$inet_tcp_int(r6, 0x6, 0x210000000013, &(0x7f0000000040)=0x100000001, 0x4)
setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r4, 0x6, 0x14, &(0x7f0000000140)=0x2, 0x4)
getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r6, 0x6, 0x15, 0x0, &(0x7f0000001880))
fcntl$setlease(r4, 0x400, 0x1)
fcntl$getflags(r4, 0x401)
ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_CLIENT(r4, 0xc04c5349, &(0x7f0000000040)={0x1, 0xfc, 0x8})
r7 = socket$inet6_tcp(0xa, 0x1, 0x0)
r8 = syz_open_dev$ttys(0xc, 0x2, 0x0)
ioctl$GIO_CMAP(r8, 0x4b70, &(0x7f0000000000))
syz_usb_connect(0x0, 0x24, &(0x7f00000001c0)=ANY=[@ANYBLOB="12010000b5b30a40450c056055b5010203010902120001000000000904", @ANYRES64=r7], 0x0)
ioctl$TIOCGPTLCK(r8, 0x5420, &(0x7f0000001d40))
getsockopt$inet6_tcp_buf(r7, 0x6, 0x1a, 0x0, &(0x7f00000003c0))

program crashed: possible deadlock in rfcomm_security_cfm
testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [22, 30]
detailed listing:
executing program 0:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) (async)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x1)
r3 = socket$netlink(0x10, 0x3, 0x0)
setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(r3, 0x10e, 0xc, &(0x7f0000000640)=0x7, 0x4) (async)
setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(r3, 0x10e, 0xc, &(0x7f0000000640)=0x7, 0x4)
sendmsg$netlink(r3, &(0x7f0000001080)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000300)={0x2c, 0x12, 0x1, 0x70bd26, 0x25dfdbfe, "", [@nested={0x10, 0x0, 0x0, 0x0, [@typed={0xc, 0xce, 0x0, 0x0, @u64}]}, @nested={0xc, 0x35, 0x0, 0x1, [@typed={0x8, 0x68, 0x0, 0x0, @u32=0x2da6}]}]}, 0x2c}], 0x1, 0x0, 0x0, 0x4000}, 0x4000800) (async)
sendmsg$netlink(r3, &(0x7f0000001080)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000300)={0x2c, 0x12, 0x1, 0x70bd26, 0x25dfdbfe, "", [@nested={0x10, 0x0, 0x0, 0x0, [@typed={0xc, 0xce, 0x0, 0x0, @u64}]}, @nested={0xc, 0x35, 0x0, 0x1, [@typed={0x8, 0x68, 0x0, 0x0, @u32=0x2da6}]}]}, 0x2c}], 0x1, 0x0, 0x0, 0x4000}, 0x4000800)
r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x1e9100, 0x0)
r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0)
syz_emit_vhci(&(0x7f0000001a40)=@HCI_EVENT_PKT={0x4, @hci_ev_auth_complete={{0x6, 0x3}, {0x0, 0xc9}}}, 0x6)
ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x2) (async)
r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x2)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r6, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000180)=[@text64={0x40, 0x0}], 0x1, 0x54, 0x0, 0x0) (async)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r6, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000180)=[@text64={0x40, 0x0}], 0x1, 0x54, 0x0, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000014000/0x18000)=nil, &(0x7f0000000100)=[@text64={0x40, 0x0}], 0x1, 0x4a, 0x0, 0x0)
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000100)={{0x14}, [@NFT_MSG_NEWTABLE={0x14, 0x0, 0xa, 0x101, 0x0, 0x0, {0x2}}], {0x14}}, 0x3c}}, 0x0)
syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@textreal={0x8, 0x0}], 0x1, 0x7a, 0x0, 0x0)
setns(0xc9, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)
socket$nl_netfilter(0x10, 0x3, 0xc)
executing program 2:
getrandom(&(0x7f0000000240)=""/286, 0xffffff9a, 0x0)
r0 = syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3)
connect$bt_rfcomm(r0, &(0x7f00000003c0)={0x1f, @none, 0x8}, 0xa)
getsockopt$sock_buf(r0, 0x1, 0x1c, 0x0, &(0x7f0000004c00))
capget(&(0x7f00000000c0)={0x19980330}, &(0x7f0000000100)={0x4, 0xfffffff7, 0x4, 0x8, 0x6, 0xffff})
r1 = socket$inet6_tcp(0xa, 0x1, 0x0)
r2 = dup(r1)
ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x9af139be227d9862}})
ioctl$TIOCMIWAIT(r2, 0x545c, 0x0)
r3 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000000)=ANY=[@ANYBLOB="500100001a00330600000000fddbdf25fe8000000000000000000000000000aafe8000000000000000000000000000aa000040002c6c80050000800000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="fe8000000000000000000000000000bb000000003200000000000000000000000000000000000001230300000000000001000080000000000000000000000000c0000000000000000040000000000000000000000000000000000000000000000800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000029bd7000033500000a000500000000000000000048000200656362286369706865725f6e756c6c290000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000005002100020000000800280000000000080027"], 0x150}, 0x1, 0x0, 0x0, 0x4000}, 0x200080d4)
r4 = openat(0xffffffffffffffff, &(0x7f00000000c0)='./file1\x00', 0x281c2, 0x0)
r5 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$inet6_int(r5, 0x29, 0x35, &(0x7f0000000000)=0x7907, 0x4)
bind$inet6(r5, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x7ff, @empty, 0x9}, 0x1c)
recvmmsg(r5, &(0x7f0000000240)=[{{0x0, 0x0, 0x0}, 0x8}], 0x1, 0x2, 0x0)
sendto$inet6(r2, 0x0, 0x0, 0x20004184, &(0x7f0000000200)={0xa, 0x4e20, 0x0, @local}, 0x1c)
r6 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$inet_tcp_int(r6, 0x6, 0x210000000013, &(0x7f0000000040)=0x100000001, 0x4)
setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r4, 0x6, 0x14, &(0x7f0000000140)=0x2, 0x4)
getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r6, 0x6, 0x15, 0x0, &(0x7f0000001880))
fcntl$setlease(r4, 0x400, 0x1)
fcntl$getflags(r4, 0x401)
ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_CLIENT(r4, 0xc04c5349, &(0x7f0000000040)={0x1, 0xfc, 0x8})
r7 = socket$inet6_tcp(0xa, 0x1, 0x0)
r8 = syz_open_dev$ttys(0xc, 0x2, 0x0)
ioctl$GIO_CMAP(r8, 0x4b70, &(0x7f0000000000))
syz_usb_connect(0x0, 0x24, &(0x7f00000001c0)=ANY=[@ANYBLOB="12010000b5b30a40450c056055b5010203010902120001000000000904", @ANYRES64=r7], 0x0)
ioctl$TIOCGPTLCK(r8, 0x5420, &(0x7f0000001d40))
getsockopt$inet6_tcp_buf(r7, 0x6, 0x1a, 0x0, &(0x7f00000003c0))

program crashed: possible deadlock in l2cap_chan_connect
testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [21, 30]
detailed listing:
executing program 0:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) (async)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x1)
r3 = socket$netlink(0x10, 0x3, 0x0)
setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(r3, 0x10e, 0xc, &(0x7f0000000640)=0x7, 0x4) (async)
setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(r3, 0x10e, 0xc, &(0x7f0000000640)=0x7, 0x4)
sendmsg$netlink(r3, &(0x7f0000001080)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000300)={0x2c, 0x12, 0x1, 0x70bd26, 0x25dfdbfe, "", [@nested={0x10, 0x0, 0x0, 0x0, [@typed={0xc, 0xce, 0x0, 0x0, @u64}]}, @nested={0xc, 0x35, 0x0, 0x1, [@typed={0x8, 0x68, 0x0, 0x0, @u32=0x2da6}]}]}, 0x2c}], 0x1, 0x0, 0x0, 0x4000}, 0x4000800) (async)
sendmsg$netlink(r3, &(0x7f0000001080)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000300)={0x2c, 0x12, 0x1, 0x70bd26, 0x25dfdbfe, "", [@nested={0x10, 0x0, 0x0, 0x0, [@typed={0xc, 0xce, 0x0, 0x0, @u64}]}, @nested={0xc, 0x35, 0x0, 0x1, [@typed={0x8, 0x68, 0x0, 0x0, @u32=0x2da6}]}]}, 0x2c}], 0x1, 0x0, 0x0, 0x4000}, 0x4000800)
r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x1e9100, 0x0)
r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0)
syz_emit_vhci(&(0x7f0000001a40)=@HCI_EVENT_PKT={0x4, @hci_ev_auth_complete={{0x6, 0x3}, {0x0, 0xc9}}}, 0x6)
ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x2) (async)
r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x2)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r6, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000180)=[@text64={0x40, 0x0}], 0x1, 0x54, 0x0, 0x0) (async)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r6, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000180)=[@text64={0x40, 0x0}], 0x1, 0x54, 0x0, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000014000/0x18000)=nil, &(0x7f0000000100)=[@text64={0x40, 0x0}], 0x1, 0x4a, 0x0, 0x0)
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000100)={{0x14}, [@NFT_MSG_NEWTABLE={0x14, 0x0, 0xa, 0x101, 0x0, 0x0, {0x2}}], {0x14}}, 0x3c}}, 0x0)
syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@textreal={0x8, 0x0}], 0x1, 0x7a, 0x0, 0x0)
setns(0xc9, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)
executing program 2:
getrandom(&(0x7f0000000240)=""/286, 0xffffff9a, 0x0)
r0 = syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3)
connect$bt_rfcomm(r0, &(0x7f00000003c0)={0x1f, @none, 0x8}, 0xa)
getsockopt$sock_buf(r0, 0x1, 0x1c, 0x0, &(0x7f0000004c00))
capget(&(0x7f00000000c0)={0x19980330}, &(0x7f0000000100)={0x4, 0xfffffff7, 0x4, 0x8, 0x6, 0xffff})
r1 = socket$inet6_tcp(0xa, 0x1, 0x0)
r2 = dup(r1)
ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x9af139be227d9862}})
ioctl$TIOCMIWAIT(r2, 0x545c, 0x0)
r3 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000000)=ANY=[@ANYBLOB="500100001a00330600000000fddbdf25fe8000000000000000000000000000aafe8000000000000000000000000000aa000040002c6c80050000800000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="fe8000000000000000000000000000bb000000003200000000000000000000000000000000000001230300000000000001000080000000000000000000000000c0000000000000000040000000000000000000000000000000000000000000000800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000029bd7000033500000a000500000000000000000048000200656362286369706865725f6e756c6c290000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000005002100020000000800280000000000080027"], 0x150}, 0x1, 0x0, 0x0, 0x4000}, 0x200080d4)
r4 = openat(0xffffffffffffffff, &(0x7f00000000c0)='./file1\x00', 0x281c2, 0x0)
r5 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$inet6_int(r5, 0x29, 0x35, &(0x7f0000000000)=0x7907, 0x4)
bind$inet6(r5, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x7ff, @empty, 0x9}, 0x1c)
recvmmsg(r5, &(0x7f0000000240)=[{{0x0, 0x0, 0x0}, 0x8}], 0x1, 0x2, 0x0)
sendto$inet6(r2, 0x0, 0x0, 0x20004184, &(0x7f0000000200)={0xa, 0x4e20, 0x0, @local}, 0x1c)
r6 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$inet_tcp_int(r6, 0x6, 0x210000000013, &(0x7f0000000040)=0x100000001, 0x4)
setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r4, 0x6, 0x14, &(0x7f0000000140)=0x2, 0x4)
getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r6, 0x6, 0x15, 0x0, &(0x7f0000001880))
fcntl$setlease(r4, 0x400, 0x1)
fcntl$getflags(r4, 0x401)
ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_CLIENT(r4, 0xc04c5349, &(0x7f0000000040)={0x1, 0xfc, 0x8})
r7 = socket$inet6_tcp(0xa, 0x1, 0x0)
r8 = syz_open_dev$ttys(0xc, 0x2, 0x0)
ioctl$GIO_CMAP(r8, 0x4b70, &(0x7f0000000000))
syz_usb_connect(0x0, 0x24, &(0x7f00000001c0)=ANY=[@ANYBLOB="12010000b5b30a40450c056055b5010203010902120001000000000904", @ANYRES64=r7], 0x0)
ioctl$TIOCGPTLCK(r8, 0x5420, &(0x7f0000001d40))
getsockopt$inet6_tcp_buf(r7, 0x6, 0x1a, 0x0, &(0x7f00000003c0))

program crashed: possible deadlock in rfcomm_security_cfm
testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [20, 30]
detailed listing:
executing program 0:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) (async)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x1)
r3 = socket$netlink(0x10, 0x3, 0x0)
setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(r3, 0x10e, 0xc, &(0x7f0000000640)=0x7, 0x4) (async)
setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(r3, 0x10e, 0xc, &(0x7f0000000640)=0x7, 0x4)
sendmsg$netlink(r3, &(0x7f0000001080)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000300)={0x2c, 0x12, 0x1, 0x70bd26, 0x25dfdbfe, "", [@nested={0x10, 0x0, 0x0, 0x0, [@typed={0xc, 0xce, 0x0, 0x0, @u64}]}, @nested={0xc, 0x35, 0x0, 0x1, [@typed={0x8, 0x68, 0x0, 0x0, @u32=0x2da6}]}]}, 0x2c}], 0x1, 0x0, 0x0, 0x4000}, 0x4000800) (async)
sendmsg$netlink(r3, &(0x7f0000001080)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000300)={0x2c, 0x12, 0x1, 0x70bd26, 0x25dfdbfe, "", [@nested={0x10, 0x0, 0x0, 0x0, [@typed={0xc, 0xce, 0x0, 0x0, @u64}]}, @nested={0xc, 0x35, 0x0, 0x1, [@typed={0x8, 0x68, 0x0, 0x0, @u32=0x2da6}]}]}, 0x2c}], 0x1, 0x0, 0x0, 0x4000}, 0x4000800)
r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x1e9100, 0x0)
r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0)
syz_emit_vhci(&(0x7f0000001a40)=@HCI_EVENT_PKT={0x4, @hci_ev_auth_complete={{0x6, 0x3}, {0x0, 0xc9}}}, 0x6)
ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x2) (async)
r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x2)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r6, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000180)=[@text64={0x40, 0x0}], 0x1, 0x54, 0x0, 0x0) (async)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r6, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000180)=[@text64={0x40, 0x0}], 0x1, 0x54, 0x0, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000014000/0x18000)=nil, &(0x7f0000000100)=[@text64={0x40, 0x0}], 0x1, 0x4a, 0x0, 0x0)
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000100)={{0x14}, [@NFT_MSG_NEWTABLE={0x14, 0x0, 0xa, 0x101, 0x0, 0x0, {0x2}}], {0x14}}, 0x3c}}, 0x0)
syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@textreal={0x8, 0x0}], 0x1, 0x7a, 0x0, 0x0)
setns(0xc9, 0x0)
executing program 2:
getrandom(&(0x7f0000000240)=""/286, 0xffffff9a, 0x0)
r0 = syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3)
connect$bt_rfcomm(r0, &(0x7f00000003c0)={0x1f, @none, 0x8}, 0xa)
getsockopt$sock_buf(r0, 0x1, 0x1c, 0x0, &(0x7f0000004c00))
capget(&(0x7f00000000c0)={0x19980330}, &(0x7f0000000100)={0x4, 0xfffffff7, 0x4, 0x8, 0x6, 0xffff})
r1 = socket$inet6_tcp(0xa, 0x1, 0x0)
r2 = dup(r1)
ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x9af139be227d9862}})
ioctl$TIOCMIWAIT(r2, 0x545c, 0x0)
r3 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000000)=ANY=[@ANYBLOB="500100001a00330600000000fddbdf25fe8000000000000000000000000000aafe8000000000000000000000000000aa000040002c6c80050000800000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="fe8000000000000000000000000000bb000000003200000000000000000000000000000000000001230300000000000001000080000000000000000000000000c0000000000000000040000000000000000000000000000000000000000000000800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000029bd7000033500000a000500000000000000000048000200656362286369706865725f6e756c6c290000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000005002100020000000800280000000000080027"], 0x150}, 0x1, 0x0, 0x0, 0x4000}, 0x200080d4)
r4 = openat(0xffffffffffffffff, &(0x7f00000000c0)='./file1\x00', 0x281c2, 0x0)
r5 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$inet6_int(r5, 0x29, 0x35, &(0x7f0000000000)=0x7907, 0x4)
bind$inet6(r5, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x7ff, @empty, 0x9}, 0x1c)
recvmmsg(r5, &(0x7f0000000240)=[{{0x0, 0x0, 0x0}, 0x8}], 0x1, 0x2, 0x0)
sendto$inet6(r2, 0x0, 0x0, 0x20004184, &(0x7f0000000200)={0xa, 0x4e20, 0x0, @local}, 0x1c)
r6 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$inet_tcp_int(r6, 0x6, 0x210000000013, &(0x7f0000000040)=0x100000001, 0x4)
setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r4, 0x6, 0x14, &(0x7f0000000140)=0x2, 0x4)
getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r6, 0x6, 0x15, 0x0, &(0x7f0000001880))
fcntl$setlease(r4, 0x400, 0x1)
fcntl$getflags(r4, 0x401)
ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_CLIENT(r4, 0xc04c5349, &(0x7f0000000040)={0x1, 0xfc, 0x8})
r7 = socket$inet6_tcp(0xa, 0x1, 0x0)
r8 = syz_open_dev$ttys(0xc, 0x2, 0x0)
ioctl$GIO_CMAP(r8, 0x4b70, &(0x7f0000000000))
syz_usb_connect(0x0, 0x24, &(0x7f00000001c0)=ANY=[@ANYBLOB="12010000b5b30a40450c056055b5010203010902120001000000000904", @ANYRES64=r7], 0x0)
ioctl$TIOCGPTLCK(r8, 0x5420, &(0x7f0000001d40))
getsockopt$inet6_tcp_buf(r7, 0x6, 0x1a, 0x0, &(0x7f00000003c0))

program crashed: possible deadlock in l2cap_chan_connect
testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [19, 30]
detailed listing:
executing program 0:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) (async)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x1)
r3 = socket$netlink(0x10, 0x3, 0x0)
setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(r3, 0x10e, 0xc, &(0x7f0000000640)=0x7, 0x4) (async)
setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(r3, 0x10e, 0xc, &(0x7f0000000640)=0x7, 0x4)
sendmsg$netlink(r3, &(0x7f0000001080)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000300)={0x2c, 0x12, 0x1, 0x70bd26, 0x25dfdbfe, "", [@nested={0x10, 0x0, 0x0, 0x0, [@typed={0xc, 0xce, 0x0, 0x0, @u64}]}, @nested={0xc, 0x35, 0x0, 0x1, [@typed={0x8, 0x68, 0x0, 0x0, @u32=0x2da6}]}]}, 0x2c}], 0x1, 0x0, 0x0, 0x4000}, 0x4000800) (async)
sendmsg$netlink(r3, &(0x7f0000001080)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000300)={0x2c, 0x12, 0x1, 0x70bd26, 0x25dfdbfe, "", [@nested={0x10, 0x0, 0x0, 0x0, [@typed={0xc, 0xce, 0x0, 0x0, @u64}]}, @nested={0xc, 0x35, 0x0, 0x1, [@typed={0x8, 0x68, 0x0, 0x0, @u32=0x2da6}]}]}, 0x2c}], 0x1, 0x0, 0x0, 0x4000}, 0x4000800)
r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x1e9100, 0x0)
r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0)
syz_emit_vhci(&(0x7f0000001a40)=@HCI_EVENT_PKT={0x4, @hci_ev_auth_complete={{0x6, 0x3}, {0x0, 0xc9}}}, 0x6)
ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x2) (async)
r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x2)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r6, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000180)=[@text64={0x40, 0x0}], 0x1, 0x54, 0x0, 0x0) (async)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r6, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000180)=[@text64={0x40, 0x0}], 0x1, 0x54, 0x0, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000014000/0x18000)=nil, &(0x7f0000000100)=[@text64={0x40, 0x0}], 0x1, 0x4a, 0x0, 0x0)
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000100)={{0x14}, [@NFT_MSG_NEWTABLE={0x14, 0x0, 0xa, 0x101, 0x0, 0x0, {0x2}}], {0x14}}, 0x3c}}, 0x0)
syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@textreal={0x8, 0x0}], 0x1, 0x7a, 0x0, 0x0)
executing program 2:
getrandom(&(0x7f0000000240)=""/286, 0xffffff9a, 0x0)
r0 = syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3)
connect$bt_rfcomm(r0, &(0x7f00000003c0)={0x1f, @none, 0x8}, 0xa)
getsockopt$sock_buf(r0, 0x1, 0x1c, 0x0, &(0x7f0000004c00))
capget(&(0x7f00000000c0)={0x19980330}, &(0x7f0000000100)={0x4, 0xfffffff7, 0x4, 0x8, 0x6, 0xffff})
r1 = socket$inet6_tcp(0xa, 0x1, 0x0)
r2 = dup(r1)
ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x9af139be227d9862}})
ioctl$TIOCMIWAIT(r2, 0x545c, 0x0)
r3 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000000)=ANY=[@ANYBLOB="500100001a00330600000000fddbdf25fe8000000000000000000000000000aafe8000000000000000000000000000aa000040002c6c80050000800000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="fe8000000000000000000000000000bb000000003200000000000000000000000000000000000001230300000000000001000080000000000000000000000000c0000000000000000040000000000000000000000000000000000000000000000800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000029bd7000033500000a000500000000000000000048000200656362286369706865725f6e756c6c290000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000005002100020000000800280000000000080027"], 0x150}, 0x1, 0x0, 0x0, 0x4000}, 0x200080d4)
r4 = openat(0xffffffffffffffff, &(0x7f00000000c0)='./file1\x00', 0x281c2, 0x0)
r5 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$inet6_int(r5, 0x29, 0x35, &(0x7f0000000000)=0x7907, 0x4)
bind$inet6(r5, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x7ff, @empty, 0x9}, 0x1c)
recvmmsg(r5, &(0x7f0000000240)=[{{0x0, 0x0, 0x0}, 0x8}], 0x1, 0x2, 0x0)
sendto$inet6(r2, 0x0, 0x0, 0x20004184, &(0x7f0000000200)={0xa, 0x4e20, 0x0, @local}, 0x1c)
r6 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$inet_tcp_int(r6, 0x6, 0x210000000013, &(0x7f0000000040)=0x100000001, 0x4)
setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r4, 0x6, 0x14, &(0x7f0000000140)=0x2, 0x4)
getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r6, 0x6, 0x15, 0x0, &(0x7f0000001880))
fcntl$setlease(r4, 0x400, 0x1)
fcntl$getflags(r4, 0x401)
ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_CLIENT(r4, 0xc04c5349, &(0x7f0000000040)={0x1, 0xfc, 0x8})
r7 = socket$inet6_tcp(0xa, 0x1, 0x0)
r8 = syz_open_dev$ttys(0xc, 0x2, 0x0)
ioctl$GIO_CMAP(r8, 0x4b70, &(0x7f0000000000))
syz_usb_connect(0x0, 0x24, &(0x7f00000001c0)=ANY=[@ANYBLOB="12010000b5b30a40450c056055b5010203010902120001000000000904", @ANYRES64=r7], 0x0)
ioctl$TIOCGPTLCK(r8, 0x5420, &(0x7f0000001d40))
getsockopt$inet6_tcp_buf(r7, 0x6, 0x1a, 0x0, &(0x7f00000003c0))

program crashed: possible deadlock in l2cap_chan_connect
testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [18, 30]
detailed listing:
executing program 0:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) (async)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x1)
r3 = socket$netlink(0x10, 0x3, 0x0)
setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(r3, 0x10e, 0xc, &(0x7f0000000640)=0x7, 0x4) (async)
setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(r3, 0x10e, 0xc, &(0x7f0000000640)=0x7, 0x4)
sendmsg$netlink(r3, &(0x7f0000001080)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000300)={0x2c, 0x12, 0x1, 0x70bd26, 0x25dfdbfe, "", [@nested={0x10, 0x0, 0x0, 0x0, [@typed={0xc, 0xce, 0x0, 0x0, @u64}]}, @nested={0xc, 0x35, 0x0, 0x1, [@typed={0x8, 0x68, 0x0, 0x0, @u32=0x2da6}]}]}, 0x2c}], 0x1, 0x0, 0x0, 0x4000}, 0x4000800) (async)
sendmsg$netlink(r3, &(0x7f0000001080)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000300)={0x2c, 0x12, 0x1, 0x70bd26, 0x25dfdbfe, "", [@nested={0x10, 0x0, 0x0, 0x0, [@typed={0xc, 0xce, 0x0, 0x0, @u64}]}, @nested={0xc, 0x35, 0x0, 0x1, [@typed={0x8, 0x68, 0x0, 0x0, @u32=0x2da6}]}]}, 0x2c}], 0x1, 0x0, 0x0, 0x4000}, 0x4000800)
r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x1e9100, 0x0)
r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0)
syz_emit_vhci(&(0x7f0000001a40)=@HCI_EVENT_PKT={0x4, @hci_ev_auth_complete={{0x6, 0x3}, {0x0, 0xc9}}}, 0x6)
ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x2) (async)
r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x2)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r6, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000180)=[@text64={0x40, 0x0}], 0x1, 0x54, 0x0, 0x0) (async)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r6, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000180)=[@text64={0x40, 0x0}], 0x1, 0x54, 0x0, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000014000/0x18000)=nil, &(0x7f0000000100)=[@text64={0x40, 0x0}], 0x1, 0x4a, 0x0, 0x0)
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000100)={{0x14}, [@NFT_MSG_NEWTABLE={0x14, 0x0, 0xa, 0x101, 0x0, 0x0, {0x2}}], {0x14}}, 0x3c}}, 0x0)
executing program 2:
getrandom(&(0x7f0000000240)=""/286, 0xffffff9a, 0x0)
r0 = syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3)
connect$bt_rfcomm(r0, &(0x7f00000003c0)={0x1f, @none, 0x8}, 0xa)
getsockopt$sock_buf(r0, 0x1, 0x1c, 0x0, &(0x7f0000004c00))
capget(&(0x7f00000000c0)={0x19980330}, &(0x7f0000000100)={0x4, 0xfffffff7, 0x4, 0x8, 0x6, 0xffff})
r1 = socket$inet6_tcp(0xa, 0x1, 0x0)
r2 = dup(r1)
ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x9af139be227d9862}})
ioctl$TIOCMIWAIT(r2, 0x545c, 0x0)
r3 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000000)=ANY=[@ANYBLOB="500100001a00330600000000fddbdf25fe8000000000000000000000000000aafe8000000000000000000000000000aa000040002c6c80050000800000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="fe8000000000000000000000000000bb000000003200000000000000000000000000000000000001230300000000000001000080000000000000000000000000c0000000000000000040000000000000000000000000000000000000000000000800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000029bd7000033500000a000500000000000000000048000200656362286369706865725f6e756c6c290000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000005002100020000000800280000000000080027"], 0x150}, 0x1, 0x0, 0x0, 0x4000}, 0x200080d4)
r4 = openat(0xffffffffffffffff, &(0x7f00000000c0)='./file1\x00', 0x281c2, 0x0)
r5 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$inet6_int(r5, 0x29, 0x35, &(0x7f0000000000)=0x7907, 0x4)
bind$inet6(r5, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x7ff, @empty, 0x9}, 0x1c)
recvmmsg(r5, &(0x7f0000000240)=[{{0x0, 0x0, 0x0}, 0x8}], 0x1, 0x2, 0x0)
sendto$inet6(r2, 0x0, 0x0, 0x20004184, &(0x7f0000000200)={0xa, 0x4e20, 0x0, @local}, 0x1c)
r6 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$inet_tcp_int(r6, 0x6, 0x210000000013, &(0x7f0000000040)=0x100000001, 0x4)
setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r4, 0x6, 0x14, &(0x7f0000000140)=0x2, 0x4)
getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r6, 0x6, 0x15, 0x0, &(0x7f0000001880))
fcntl$setlease(r4, 0x400, 0x1)
fcntl$getflags(r4, 0x401)
ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_CLIENT(r4, 0xc04c5349, &(0x7f0000000040)={0x1, 0xfc, 0x8})
r7 = socket$inet6_tcp(0xa, 0x1, 0x0)
r8 = syz_open_dev$ttys(0xc, 0x2, 0x0)
ioctl$GIO_CMAP(r8, 0x4b70, &(0x7f0000000000))
syz_usb_connect(0x0, 0x24, &(0x7f00000001c0)=ANY=[@ANYBLOB="12010000b5b30a40450c056055b5010203010902120001000000000904", @ANYRES64=r7], 0x0)
ioctl$TIOCGPTLCK(r8, 0x5420, &(0x7f0000001d40))
getsockopt$inet6_tcp_buf(r7, 0x6, 0x1a, 0x0, &(0x7f00000003c0))

program crashed: possible deadlock in l2cap_chan_connect
testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [17, 30]
detailed listing:
executing program 0:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) (async)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x1)
r3 = socket$netlink(0x10, 0x3, 0x0)
setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(r3, 0x10e, 0xc, &(0x7f0000000640)=0x7, 0x4) (async)
setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(r3, 0x10e, 0xc, &(0x7f0000000640)=0x7, 0x4)
sendmsg$netlink(r3, &(0x7f0000001080)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000300)={0x2c, 0x12, 0x1, 0x70bd26, 0x25dfdbfe, "", [@nested={0x10, 0x0, 0x0, 0x0, [@typed={0xc, 0xce, 0x0, 0x0, @u64}]}, @nested={0xc, 0x35, 0x0, 0x1, [@typed={0x8, 0x68, 0x0, 0x0, @u32=0x2da6}]}]}, 0x2c}], 0x1, 0x0, 0x0, 0x4000}, 0x4000800) (async)
sendmsg$netlink(r3, &(0x7f0000001080)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000300)={0x2c, 0x12, 0x1, 0x70bd26, 0x25dfdbfe, "", [@nested={0x10, 0x0, 0x0, 0x0, [@typed={0xc, 0xce, 0x0, 0x0, @u64}]}, @nested={0xc, 0x35, 0x0, 0x1, [@typed={0x8, 0x68, 0x0, 0x0, @u32=0x2da6}]}]}, 0x2c}], 0x1, 0x0, 0x0, 0x4000}, 0x4000800)
r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x1e9100, 0x0)
r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0)
syz_emit_vhci(&(0x7f0000001a40)=@HCI_EVENT_PKT={0x4, @hci_ev_auth_complete={{0x6, 0x3}, {0x0, 0xc9}}}, 0x6)
ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x2) (async)
r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x2)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r6, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000180)=[@text64={0x40, 0x0}], 0x1, 0x54, 0x0, 0x0) (async)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r6, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000180)=[@text64={0x40, 0x0}], 0x1, 0x54, 0x0, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000014000/0x18000)=nil, &(0x7f0000000100)=[@text64={0x40, 0x0}], 0x1, 0x4a, 0x0, 0x0)
executing program 2:
getrandom(&(0x7f0000000240)=""/286, 0xffffff9a, 0x0)
r0 = syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3)
connect$bt_rfcomm(r0, &(0x7f00000003c0)={0x1f, @none, 0x8}, 0xa)
getsockopt$sock_buf(r0, 0x1, 0x1c, 0x0, &(0x7f0000004c00))
capget(&(0x7f00000000c0)={0x19980330}, &(0x7f0000000100)={0x4, 0xfffffff7, 0x4, 0x8, 0x6, 0xffff})
r1 = socket$inet6_tcp(0xa, 0x1, 0x0)
r2 = dup(r1)
ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x9af139be227d9862}})
ioctl$TIOCMIWAIT(r2, 0x545c, 0x0)
r3 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000000)=ANY=[@ANYBLOB="500100001a00330600000000fddbdf25fe8000000000000000000000000000aafe8000000000000000000000000000aa000040002c6c80050000800000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="fe8000000000000000000000000000bb000000003200000000000000000000000000000000000001230300000000000001000080000000000000000000000000c0000000000000000040000000000000000000000000000000000000000000000800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000029bd7000033500000a000500000000000000000048000200656362286369706865725f6e756c6c290000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000005002100020000000800280000000000080027"], 0x150}, 0x1, 0x0, 0x0, 0x4000}, 0x200080d4)
r4 = openat(0xffffffffffffffff, &(0x7f00000000c0)='./file1\x00', 0x281c2, 0x0)
r5 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$inet6_int(r5, 0x29, 0x35, &(0x7f0000000000)=0x7907, 0x4)
bind$inet6(r5, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x7ff, @empty, 0x9}, 0x1c)
recvmmsg(r5, &(0x7f0000000240)=[{{0x0, 0x0, 0x0}, 0x8}], 0x1, 0x2, 0x0)
sendto$inet6(r2, 0x0, 0x0, 0x20004184, &(0x7f0000000200)={0xa, 0x4e20, 0x0, @local}, 0x1c)
r6 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$inet_tcp_int(r6, 0x6, 0x210000000013, &(0x7f0000000040)=0x100000001, 0x4)
setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r4, 0x6, 0x14, &(0x7f0000000140)=0x2, 0x4)
getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r6, 0x6, 0x15, 0x0, &(0x7f0000001880))
fcntl$setlease(r4, 0x400, 0x1)
fcntl$getflags(r4, 0x401)
ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_CLIENT(r4, 0xc04c5349, &(0x7f0000000040)={0x1, 0xfc, 0x8})
r7 = socket$inet6_tcp(0xa, 0x1, 0x0)
r8 = syz_open_dev$ttys(0xc, 0x2, 0x0)
ioctl$GIO_CMAP(r8, 0x4b70, &(0x7f0000000000))
syz_usb_connect(0x0, 0x24, &(0x7f00000001c0)=ANY=[@ANYBLOB="12010000b5b30a40450c056055b5010203010902120001000000000904", @ANYRES64=r7], 0x0)
ioctl$TIOCGPTLCK(r8, 0x5420, &(0x7f0000001d40))
getsockopt$inet6_tcp_buf(r7, 0x6, 0x1a, 0x0, &(0x7f00000003c0))

program crashed: possible deadlock in l2cap_chan_connect
testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [16, 30]
detailed listing:
executing program 0:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) (async)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x1)
r2 = socket$netlink(0x10, 0x3, 0x0)
setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(r2, 0x10e, 0xc, &(0x7f0000000640)=0x7, 0x4) (async)
setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(r2, 0x10e, 0xc, &(0x7f0000000640)=0x7, 0x4)
sendmsg$netlink(r2, &(0x7f0000001080)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000300)={0x2c, 0x12, 0x1, 0x70bd26, 0x25dfdbfe, "", [@nested={0x10, 0x0, 0x0, 0x0, [@typed={0xc, 0xce, 0x0, 0x0, @u64}]}, @nested={0xc, 0x35, 0x0, 0x1, [@typed={0x8, 0x68, 0x0, 0x0, @u32=0x2da6}]}]}, 0x2c}], 0x1, 0x0, 0x0, 0x4000}, 0x4000800) (async)
sendmsg$netlink(r2, &(0x7f0000001080)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000300)={0x2c, 0x12, 0x1, 0x70bd26, 0x25dfdbfe, "", [@nested={0x10, 0x0, 0x0, 0x0, [@typed={0xc, 0xce, 0x0, 0x0, @u64}]}, @nested={0xc, 0x35, 0x0, 0x1, [@typed={0x8, 0x68, 0x0, 0x0, @u32=0x2da6}]}]}, 0x2c}], 0x1, 0x0, 0x0, 0x4000}, 0x4000800)
r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x1e9100, 0x0)
r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0)
syz_emit_vhci(&(0x7f0000001a40)=@HCI_EVENT_PKT={0x4, @hci_ev_auth_complete={{0x6, 0x3}, {0x0, 0xc9}}}, 0x6)
ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x2) (async)
r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x2)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r5, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000180)=[@text64={0x40, 0x0}], 0x1, 0x54, 0x0, 0x0) (async)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r5, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000180)=[@text64={0x40, 0x0}], 0x1, 0x54, 0x0, 0x0)
executing program 2:
getrandom(&(0x7f0000000240)=""/286, 0xffffff9a, 0x0)
r0 = syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3)
connect$bt_rfcomm(r0, &(0x7f00000003c0)={0x1f, @none, 0x8}, 0xa)
getsockopt$sock_buf(r0, 0x1, 0x1c, 0x0, &(0x7f0000004c00))
capget(&(0x7f00000000c0)={0x19980330}, &(0x7f0000000100)={0x4, 0xfffffff7, 0x4, 0x8, 0x6, 0xffff})
r1 = socket$inet6_tcp(0xa, 0x1, 0x0)
r2 = dup(r1)
ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x9af139be227d9862}})
ioctl$TIOCMIWAIT(r2, 0x545c, 0x0)
r3 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000000)=ANY=[@ANYBLOB="500100001a00330600000000fddbdf25fe8000000000000000000000000000aafe8000000000000000000000000000aa000040002c6c80050000800000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="fe8000000000000000000000000000bb000000003200000000000000000000000000000000000001230300000000000001000080000000000000000000000000c0000000000000000040000000000000000000000000000000000000000000000800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000029bd7000033500000a000500000000000000000048000200656362286369706865725f6e756c6c290000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000005002100020000000800280000000000080027"], 0x150}, 0x1, 0x0, 0x0, 0x4000}, 0x200080d4)
r4 = openat(0xffffffffffffffff, &(0x7f00000000c0)='./file1\x00', 0x281c2, 0x0)
r5 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$inet6_int(r5, 0x29, 0x35, &(0x7f0000000000)=0x7907, 0x4)
bind$inet6(r5, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x7ff, @empty, 0x9}, 0x1c)
recvmmsg(r5, &(0x7f0000000240)=[{{0x0, 0x0, 0x0}, 0x8}], 0x1, 0x2, 0x0)
sendto$inet6(r2, 0x0, 0x0, 0x20004184, &(0x7f0000000200)={0xa, 0x4e20, 0x0, @local}, 0x1c)
r6 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$inet_tcp_int(r6, 0x6, 0x210000000013, &(0x7f0000000040)=0x100000001, 0x4)
setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r4, 0x6, 0x14, &(0x7f0000000140)=0x2, 0x4)
getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r6, 0x6, 0x15, 0x0, &(0x7f0000001880))
fcntl$setlease(r4, 0x400, 0x1)
fcntl$getflags(r4, 0x401)
ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_CLIENT(r4, 0xc04c5349, &(0x7f0000000040)={0x1, 0xfc, 0x8})
r7 = socket$inet6_tcp(0xa, 0x1, 0x0)
r8 = syz_open_dev$ttys(0xc, 0x2, 0x0)
ioctl$GIO_CMAP(r8, 0x4b70, &(0x7f0000000000))
syz_usb_connect(0x0, 0x24, &(0x7f00000001c0)=ANY=[@ANYBLOB="12010000b5b30a40450c056055b5010203010902120001000000000904", @ANYRES64=r7], 0x0)
ioctl$TIOCGPTLCK(r8, 0x5420, &(0x7f0000001d40))
getsockopt$inet6_tcp_buf(r7, 0x6, 0x1a, 0x0, &(0x7f00000003c0))

program crashed: possible deadlock in l2cap_chan_connect
testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [15, 30]
detailed listing:
executing program 0:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) (async)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x1)
r2 = socket$netlink(0x10, 0x3, 0x0)
setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(r2, 0x10e, 0xc, &(0x7f0000000640)=0x7, 0x4) (async)
setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(r2, 0x10e, 0xc, &(0x7f0000000640)=0x7, 0x4)
sendmsg$netlink(r2, &(0x7f0000001080)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000300)={0x2c, 0x12, 0x1, 0x70bd26, 0x25dfdbfe, "", [@nested={0x10, 0x0, 0x0, 0x0, [@typed={0xc, 0xce, 0x0, 0x0, @u64}]}, @nested={0xc, 0x35, 0x0, 0x1, [@typed={0x8, 0x68, 0x0, 0x0, @u32=0x2da6}]}]}, 0x2c}], 0x1, 0x0, 0x0, 0x4000}, 0x4000800) (async)
sendmsg$netlink(r2, &(0x7f0000001080)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000300)={0x2c, 0x12, 0x1, 0x70bd26, 0x25dfdbfe, "", [@nested={0x10, 0x0, 0x0, 0x0, [@typed={0xc, 0xce, 0x0, 0x0, @u64}]}, @nested={0xc, 0x35, 0x0, 0x1, [@typed={0x8, 0x68, 0x0, 0x0, @u32=0x2da6}]}]}, 0x2c}], 0x1, 0x0, 0x0, 0x4000}, 0x4000800)
r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x1e9100, 0x0)
r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0)
syz_emit_vhci(&(0x7f0000001a40)=@HCI_EVENT_PKT={0x4, @hci_ev_auth_complete={{0x6, 0x3}, {0x0, 0xc9}}}, 0x6)
ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x2) (async)
r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x2)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r5, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000180)=[@text64={0x40, 0x0}], 0x1, 0x54, 0x0, 0x0) (async)
executing program 2:
getrandom(&(0x7f0000000240)=""/286, 0xffffff9a, 0x0)
r0 = syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3)
connect$bt_rfcomm(r0, &(0x7f00000003c0)={0x1f, @none, 0x8}, 0xa)
getsockopt$sock_buf(r0, 0x1, 0x1c, 0x0, &(0x7f0000004c00))
capget(&(0x7f00000000c0)={0x19980330}, &(0x7f0000000100)={0x4, 0xfffffff7, 0x4, 0x8, 0x6, 0xffff})
r1 = socket$inet6_tcp(0xa, 0x1, 0x0)
r2 = dup(r1)
ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x9af139be227d9862}})
ioctl$TIOCMIWAIT(r2, 0x545c, 0x0)
r3 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000000)=ANY=[@ANYBLOB="500100001a00330600000000fddbdf25fe8000000000000000000000000000aafe8000000000000000000000000000aa000040002c6c80050000800000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="fe8000000000000000000000000000bb000000003200000000000000000000000000000000000001230300000000000001000080000000000000000000000000c0000000000000000040000000000000000000000000000000000000000000000800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000029bd7000033500000a000500000000000000000048000200656362286369706865725f6e756c6c290000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000005002100020000000800280000000000080027"], 0x150}, 0x1, 0x0, 0x0, 0x4000}, 0x200080d4)
r4 = openat(0xffffffffffffffff, &(0x7f00000000c0)='./file1\x00', 0x281c2, 0x0)
r5 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$inet6_int(r5, 0x29, 0x35, &(0x7f0000000000)=0x7907, 0x4)
bind$inet6(r5, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x7ff, @empty, 0x9}, 0x1c)
recvmmsg(r5, &(0x7f0000000240)=[{{0x0, 0x0, 0x0}, 0x8}], 0x1, 0x2, 0x0)
sendto$inet6(r2, 0x0, 0x0, 0x20004184, &(0x7f0000000200)={0xa, 0x4e20, 0x0, @local}, 0x1c)
r6 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$inet_tcp_int(r6, 0x6, 0x210000000013, &(0x7f0000000040)=0x100000001, 0x4)
setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r4, 0x6, 0x14, &(0x7f0000000140)=0x2, 0x4)
getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r6, 0x6, 0x15, 0x0, &(0x7f0000001880))
fcntl$setlease(r4, 0x400, 0x1)
fcntl$getflags(r4, 0x401)
ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_CLIENT(r4, 0xc04c5349, &(0x7f0000000040)={0x1, 0xfc, 0x8})
r7 = socket$inet6_tcp(0xa, 0x1, 0x0)
r8 = syz_open_dev$ttys(0xc, 0x2, 0x0)
ioctl$GIO_CMAP(r8, 0x4b70, &(0x7f0000000000))
syz_usb_connect(0x0, 0x24, &(0x7f00000001c0)=ANY=[@ANYBLOB="12010000b5b30a40450c056055b5010203010902120001000000000904", @ANYRES64=r7], 0x0)
ioctl$TIOCGPTLCK(r8, 0x5420, &(0x7f0000001d40))
getsockopt$inet6_tcp_buf(r7, 0x6, 0x1a, 0x0, &(0x7f00000003c0))

program crashed: possible deadlock in rfcomm_security_cfm
testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [14, 30]
detailed listing:
executing program 0:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) (async)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x1)
r2 = socket$netlink(0x10, 0x3, 0x0)
setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(r2, 0x10e, 0xc, &(0x7f0000000640)=0x7, 0x4) (async)
setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(r2, 0x10e, 0xc, &(0x7f0000000640)=0x7, 0x4)
sendmsg$netlink(r2, &(0x7f0000001080)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000300)={0x2c, 0x12, 0x1, 0x70bd26, 0x25dfdbfe, "", [@nested={0x10, 0x0, 0x0, 0x0, [@typed={0xc, 0xce, 0x0, 0x0, @u64}]}, @nested={0xc, 0x35, 0x0, 0x1, [@typed={0x8, 0x68, 0x0, 0x0, @u32=0x2da6}]}]}, 0x2c}], 0x1, 0x0, 0x0, 0x4000}, 0x4000800) (async)
sendmsg$netlink(r2, &(0x7f0000001080)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000300)={0x2c, 0x12, 0x1, 0x70bd26, 0x25dfdbfe, "", [@nested={0x10, 0x0, 0x0, 0x0, [@typed={0xc, 0xce, 0x0, 0x0, @u64}]}, @nested={0xc, 0x35, 0x0, 0x1, [@typed={0x8, 0x68, 0x0, 0x0, @u32=0x2da6}]}]}, 0x2c}], 0x1, 0x0, 0x0, 0x4000}, 0x4000800)
r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x1e9100, 0x0)
r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0)
syz_emit_vhci(&(0x7f0000001a40)=@HCI_EVENT_PKT={0x4, @hci_ev_auth_complete={{0x6, 0x3}, {0x0, 0xc9}}}, 0x6)
ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x2) (async)
ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x2)
executing program 2:
getrandom(&(0x7f0000000240)=""/286, 0xffffff9a, 0x0)
r0 = syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3)
connect$bt_rfcomm(r0, &(0x7f00000003c0)={0x1f, @none, 0x8}, 0xa)
getsockopt$sock_buf(r0, 0x1, 0x1c, 0x0, &(0x7f0000004c00))
capget(&(0x7f00000000c0)={0x19980330}, &(0x7f0000000100)={0x4, 0xfffffff7, 0x4, 0x8, 0x6, 0xffff})
r1 = socket$inet6_tcp(0xa, 0x1, 0x0)
r2 = dup(r1)
ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x9af139be227d9862}})
ioctl$TIOCMIWAIT(r2, 0x545c, 0x0)
r3 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000000)=ANY=[@ANYBLOB="500100001a00330600000000fddbdf25fe8000000000000000000000000000aafe8000000000000000000000000000aa000040002c6c80050000800000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="fe8000000000000000000000000000bb000000003200000000000000000000000000000000000001230300000000000001000080000000000000000000000000c0000000000000000040000000000000000000000000000000000000000000000800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000029bd7000033500000a000500000000000000000048000200656362286369706865725f6e756c6c290000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000005002100020000000800280000000000080027"], 0x150}, 0x1, 0x0, 0x0, 0x4000}, 0x200080d4)
r4 = openat(0xffffffffffffffff, &(0x7f00000000c0)='./file1\x00', 0x281c2, 0x0)
r5 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$inet6_int(r5, 0x29, 0x35, &(0x7f0000000000)=0x7907, 0x4)
bind$inet6(r5, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x7ff, @empty, 0x9}, 0x1c)
recvmmsg(r5, &(0x7f0000000240)=[{{0x0, 0x0, 0x0}, 0x8}], 0x1, 0x2, 0x0)
sendto$inet6(r2, 0x0, 0x0, 0x20004184, &(0x7f0000000200)={0xa, 0x4e20, 0x0, @local}, 0x1c)
r6 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$inet_tcp_int(r6, 0x6, 0x210000000013, &(0x7f0000000040)=0x100000001, 0x4)
setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r4, 0x6, 0x14, &(0x7f0000000140)=0x2, 0x4)
getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r6, 0x6, 0x15, 0x0, &(0x7f0000001880))
fcntl$setlease(r4, 0x400, 0x1)
fcntl$getflags(r4, 0x401)
ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_CLIENT(r4, 0xc04c5349, &(0x7f0000000040)={0x1, 0xfc, 0x8})
r7 = socket$inet6_tcp(0xa, 0x1, 0x0)
r8 = syz_open_dev$ttys(0xc, 0x2, 0x0)
ioctl$GIO_CMAP(r8, 0x4b70, &(0x7f0000000000))
syz_usb_connect(0x0, 0x24, &(0x7f00000001c0)=ANY=[@ANYBLOB="12010000b5b30a40450c056055b5010203010902120001000000000904", @ANYRES64=r7], 0x0)
ioctl$TIOCGPTLCK(r8, 0x5420, &(0x7f0000001d40))
getsockopt$inet6_tcp_buf(r7, 0x6, 0x1a, 0x0, &(0x7f00000003c0))

program crashed: possible deadlock in l2cap_chan_connect
testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [13, 30]
detailed listing:
executing program 0:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) (async)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x1)
r2 = socket$netlink(0x10, 0x3, 0x0)
setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(r2, 0x10e, 0xc, &(0x7f0000000640)=0x7, 0x4) (async)
setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(r2, 0x10e, 0xc, &(0x7f0000000640)=0x7, 0x4)
sendmsg$netlink(r2, &(0x7f0000001080)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000300)={0x2c, 0x12, 0x1, 0x70bd26, 0x25dfdbfe, "", [@nested={0x10, 0x0, 0x0, 0x0, [@typed={0xc, 0xce, 0x0, 0x0, @u64}]}, @nested={0xc, 0x35, 0x0, 0x1, [@typed={0x8, 0x68, 0x0, 0x0, @u32=0x2da6}]}]}, 0x2c}], 0x1, 0x0, 0x0, 0x4000}, 0x4000800) (async)
sendmsg$netlink(r2, &(0x7f0000001080)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000300)={0x2c, 0x12, 0x1, 0x70bd26, 0x25dfdbfe, "", [@nested={0x10, 0x0, 0x0, 0x0, [@typed={0xc, 0xce, 0x0, 0x0, @u64}]}, @nested={0xc, 0x35, 0x0, 0x1, [@typed={0x8, 0x68, 0x0, 0x0, @u32=0x2da6}]}]}, 0x2c}], 0x1, 0x0, 0x0, 0x4000}, 0x4000800)
r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x1e9100, 0x0)
r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0)
syz_emit_vhci(&(0x7f0000001a40)=@HCI_EVENT_PKT={0x4, @hci_ev_auth_complete={{0x6, 0x3}, {0x0, 0xc9}}}, 0x6)
ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x2) (async)
executing program 2:
getrandom(&(0x7f0000000240)=""/286, 0xffffff9a, 0x0)
r0 = syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3)
connect$bt_rfcomm(r0, &(0x7f00000003c0)={0x1f, @none, 0x8}, 0xa)
getsockopt$sock_buf(r0, 0x1, 0x1c, 0x0, &(0x7f0000004c00))
capget(&(0x7f00000000c0)={0x19980330}, &(0x7f0000000100)={0x4, 0xfffffff7, 0x4, 0x8, 0x6, 0xffff})
r1 = socket$inet6_tcp(0xa, 0x1, 0x0)
r2 = dup(r1)
ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x9af139be227d9862}})
ioctl$TIOCMIWAIT(r2, 0x545c, 0x0)
r3 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000000)=ANY=[@ANYBLOB="500100001a00330600000000fddbdf25fe8000000000000000000000000000aafe8000000000000000000000000000aa000040002c6c80050000800000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="fe8000000000000000000000000000bb000000003200000000000000000000000000000000000001230300000000000001000080000000000000000000000000c0000000000000000040000000000000000000000000000000000000000000000800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000029bd7000033500000a000500000000000000000048000200656362286369706865725f6e756c6c290000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000005002100020000000800280000000000080027"], 0x150}, 0x1, 0x0, 0x0, 0x4000}, 0x200080d4)
r4 = openat(0xffffffffffffffff, &(0x7f00000000c0)='./file1\x00', 0x281c2, 0x0)
r5 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$inet6_int(r5, 0x29, 0x35, &(0x7f0000000000)=0x7907, 0x4)
bind$inet6(r5, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x7ff, @empty, 0x9}, 0x1c)
recvmmsg(r5, &(0x7f0000000240)=[{{0x0, 0x0, 0x0}, 0x8}], 0x1, 0x2, 0x0)
sendto$inet6(r2, 0x0, 0x0, 0x20004184, &(0x7f0000000200)={0xa, 0x4e20, 0x0, @local}, 0x1c)
r6 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$inet_tcp_int(r6, 0x6, 0x210000000013, &(0x7f0000000040)=0x100000001, 0x4)
setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r4, 0x6, 0x14, &(0x7f0000000140)=0x2, 0x4)
getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r6, 0x6, 0x15, 0x0, &(0x7f0000001880))
fcntl$setlease(r4, 0x400, 0x1)
fcntl$getflags(r4, 0x401)
ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_CLIENT(r4, 0xc04c5349, &(0x7f0000000040)={0x1, 0xfc, 0x8})
r7 = socket$inet6_tcp(0xa, 0x1, 0x0)
r8 = syz_open_dev$ttys(0xc, 0x2, 0x0)
ioctl$GIO_CMAP(r8, 0x4b70, &(0x7f0000000000))
syz_usb_connect(0x0, 0x24, &(0x7f00000001c0)=ANY=[@ANYBLOB="12010000b5b30a40450c056055b5010203010902120001000000000904", @ANYRES64=r7], 0x0)
ioctl$TIOCGPTLCK(r8, 0x5420, &(0x7f0000001d40))
getsockopt$inet6_tcp_buf(r7, 0x6, 0x1a, 0x0, &(0x7f00000003c0))

program crashed: possible deadlock in l2cap_chan_connect
testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [12, 30]
detailed listing:
executing program 0:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) (async)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x1)
r2 = socket$netlink(0x10, 0x3, 0x0)
setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(r2, 0x10e, 0xc, &(0x7f0000000640)=0x7, 0x4) (async)
setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(r2, 0x10e, 0xc, &(0x7f0000000640)=0x7, 0x4)
sendmsg$netlink(r2, &(0x7f0000001080)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000300)={0x2c, 0x12, 0x1, 0x70bd26, 0x25dfdbfe, "", [@nested={0x10, 0x0, 0x0, 0x0, [@typed={0xc, 0xce, 0x0, 0x0, @u64}]}, @nested={0xc, 0x35, 0x0, 0x1, [@typed={0x8, 0x68, 0x0, 0x0, @u32=0x2da6}]}]}, 0x2c}], 0x1, 0x0, 0x0, 0x4000}, 0x4000800) (async)
sendmsg$netlink(r2, &(0x7f0000001080)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000300)={0x2c, 0x12, 0x1, 0x70bd26, 0x25dfdbfe, "", [@nested={0x10, 0x0, 0x0, 0x0, [@typed={0xc, 0xce, 0x0, 0x0, @u64}]}, @nested={0xc, 0x35, 0x0, 0x1, [@typed={0x8, 0x68, 0x0, 0x0, @u32=0x2da6}]}]}, 0x2c}], 0x1, 0x0, 0x0, 0x4000}, 0x4000800)
r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x1e9100, 0x0)
ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0)
syz_emit_vhci(&(0x7f0000001a40)=@HCI_EVENT_PKT={0x4, @hci_ev_auth_complete={{0x6, 0x3}, {0x0, 0xc9}}}, 0x6)
executing program 2:
getrandom(&(0x7f0000000240)=""/286, 0xffffff9a, 0x0)
r0 = syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3)
connect$bt_rfcomm(r0, &(0x7f00000003c0)={0x1f, @none, 0x8}, 0xa)
getsockopt$sock_buf(r0, 0x1, 0x1c, 0x0, &(0x7f0000004c00))
capget(&(0x7f00000000c0)={0x19980330}, &(0x7f0000000100)={0x4, 0xfffffff7, 0x4, 0x8, 0x6, 0xffff})
r1 = socket$inet6_tcp(0xa, 0x1, 0x0)
r2 = dup(r1)
ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x9af139be227d9862}})
ioctl$TIOCMIWAIT(r2, 0x545c, 0x0)
r3 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000000)=ANY=[@ANYBLOB="500100001a00330600000000fddbdf25fe8000000000000000000000000000aafe8000000000000000000000000000aa000040002c6c80050000800000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="fe8000000000000000000000000000bb000000003200000000000000000000000000000000000001230300000000000001000080000000000000000000000000c0000000000000000040000000000000000000000000000000000000000000000800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000029bd7000033500000a000500000000000000000048000200656362286369706865725f6e756c6c290000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000005002100020000000800280000000000080027"], 0x150}, 0x1, 0x0, 0x0, 0x4000}, 0x200080d4)
r4 = openat(0xffffffffffffffff, &(0x7f00000000c0)='./file1\x00', 0x281c2, 0x0)
r5 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$inet6_int(r5, 0x29, 0x35, &(0x7f0000000000)=0x7907, 0x4)
bind$inet6(r5, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x7ff, @empty, 0x9}, 0x1c)
recvmmsg(r5, &(0x7f0000000240)=[{{0x0, 0x0, 0x0}, 0x8}], 0x1, 0x2, 0x0)
sendto$inet6(r2, 0x0, 0x0, 0x20004184, &(0x7f0000000200)={0xa, 0x4e20, 0x0, @local}, 0x1c)
r6 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$inet_tcp_int(r6, 0x6, 0x210000000013, &(0x7f0000000040)=0x100000001, 0x4)
setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r4, 0x6, 0x14, &(0x7f0000000140)=0x2, 0x4)
getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r6, 0x6, 0x15, 0x0, &(0x7f0000001880))
fcntl$setlease(r4, 0x400, 0x1)
fcntl$getflags(r4, 0x401)
ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_CLIENT(r4, 0xc04c5349, &(0x7f0000000040)={0x1, 0xfc, 0x8})
r7 = socket$inet6_tcp(0xa, 0x1, 0x0)
r8 = syz_open_dev$ttys(0xc, 0x2, 0x0)
ioctl$GIO_CMAP(r8, 0x4b70, &(0x7f0000000000))
syz_usb_connect(0x0, 0x24, &(0x7f00000001c0)=ANY=[@ANYBLOB="12010000b5b30a40450c056055b5010203010902120001000000000904", @ANYRES64=r7], 0x0)
ioctl$TIOCGPTLCK(r8, 0x5420, &(0x7f0000001d40))
getsockopt$inet6_tcp_buf(r7, 0x6, 0x1a, 0x0, &(0x7f00000003c0))

program crashed: possible deadlock in l2cap_chan_connect
testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [11, 30]
detailed listing:
executing program 0:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) (async)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x1)
r2 = socket$netlink(0x10, 0x3, 0x0)
setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(r2, 0x10e, 0xc, &(0x7f0000000640)=0x7, 0x4) (async)
setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(r2, 0x10e, 0xc, &(0x7f0000000640)=0x7, 0x4)
sendmsg$netlink(r2, &(0x7f0000001080)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000300)={0x2c, 0x12, 0x1, 0x70bd26, 0x25dfdbfe, "", [@nested={0x10, 0x0, 0x0, 0x0, [@typed={0xc, 0xce, 0x0, 0x0, @u64}]}, @nested={0xc, 0x35, 0x0, 0x1, [@typed={0x8, 0x68, 0x0, 0x0, @u32=0x2da6}]}]}, 0x2c}], 0x1, 0x0, 0x0, 0x4000}, 0x4000800) (async)
sendmsg$netlink(r2, &(0x7f0000001080)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000300)={0x2c, 0x12, 0x1, 0x70bd26, 0x25dfdbfe, "", [@nested={0x10, 0x0, 0x0, 0x0, [@typed={0xc, 0xce, 0x0, 0x0, @u64}]}, @nested={0xc, 0x35, 0x0, 0x1, [@typed={0x8, 0x68, 0x0, 0x0, @u32=0x2da6}]}]}, 0x2c}], 0x1, 0x0, 0x0, 0x4000}, 0x4000800)
r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x1e9100, 0x0)
ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0)
executing program 2:
getrandom(&(0x7f0000000240)=""/286, 0xffffff9a, 0x0)
r0 = syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3)
connect$bt_rfcomm(r0, &(0x7f00000003c0)={0x1f, @none, 0x8}, 0xa)
getsockopt$sock_buf(r0, 0x1, 0x1c, 0x0, &(0x7f0000004c00))
capget(&(0x7f00000000c0)={0x19980330}, &(0x7f0000000100)={0x4, 0xfffffff7, 0x4, 0x8, 0x6, 0xffff})
r1 = socket$inet6_tcp(0xa, 0x1, 0x0)
r2 = dup(r1)
ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x9af139be227d9862}})
ioctl$TIOCMIWAIT(r2, 0x545c, 0x0)
r3 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000000)=ANY=[@ANYBLOB="500100001a00330600000000fddbdf25fe8000000000000000000000000000aafe8000000000000000000000000000aa000040002c6c80050000800000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="fe8000000000000000000000000000bb000000003200000000000000000000000000000000000001230300000000000001000080000000000000000000000000c0000000000000000040000000000000000000000000000000000000000000000800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000029bd7000033500000a000500000000000000000048000200656362286369706865725f6e756c6c290000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000005002100020000000800280000000000080027"], 0x150}, 0x1, 0x0, 0x0, 0x4000}, 0x200080d4)
r4 = openat(0xffffffffffffffff, &(0x7f00000000c0)='./file1\x00', 0x281c2, 0x0)
r5 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$inet6_int(r5, 0x29, 0x35, &(0x7f0000000000)=0x7907, 0x4)
bind$inet6(r5, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x7ff, @empty, 0x9}, 0x1c)
recvmmsg(r5, &(0x7f0000000240)=[{{0x0, 0x0, 0x0}, 0x8}], 0x1, 0x2, 0x0)
sendto$inet6(r2, 0x0, 0x0, 0x20004184, &(0x7f0000000200)={0xa, 0x4e20, 0x0, @local}, 0x1c)
r6 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$inet_tcp_int(r6, 0x6, 0x210000000013, &(0x7f0000000040)=0x100000001, 0x4)
setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r4, 0x6, 0x14, &(0x7f0000000140)=0x2, 0x4)
getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r6, 0x6, 0x15, 0x0, &(0x7f0000001880))
fcntl$setlease(r4, 0x400, 0x1)
fcntl$getflags(r4, 0x401)
ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_CLIENT(r4, 0xc04c5349, &(0x7f0000000040)={0x1, 0xfc, 0x8})
r7 = socket$inet6_tcp(0xa, 0x1, 0x0)
r8 = syz_open_dev$ttys(0xc, 0x2, 0x0)
ioctl$GIO_CMAP(r8, 0x4b70, &(0x7f0000000000))
syz_usb_connect(0x0, 0x24, &(0x7f00000001c0)=ANY=[@ANYBLOB="12010000b5b30a40450c056055b5010203010902120001000000000904", @ANYRES64=r7], 0x0)
ioctl$TIOCGPTLCK(r8, 0x5420, &(0x7f0000001d40))
getsockopt$inet6_tcp_buf(r7, 0x6, 0x1a, 0x0, &(0x7f00000003c0))

program did not crash
testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [11, 30]
detailed listing:
executing program 0:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) (async)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x1)
r2 = socket$netlink(0x10, 0x3, 0x0)
setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(r2, 0x10e, 0xc, &(0x7f0000000640)=0x7, 0x4) (async)
setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(r2, 0x10e, 0xc, &(0x7f0000000640)=0x7, 0x4)
sendmsg$netlink(r2, &(0x7f0000001080)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000300)={0x2c, 0x12, 0x1, 0x70bd26, 0x25dfdbfe, "", [@nested={0x10, 0x0, 0x0, 0x0, [@typed={0xc, 0xce, 0x0, 0x0, @u64}]}, @nested={0xc, 0x35, 0x0, 0x1, [@typed={0x8, 0x68, 0x0, 0x0, @u32=0x2da6}]}]}, 0x2c}], 0x1, 0x0, 0x0, 0x4000}, 0x4000800) (async)
sendmsg$netlink(r2, &(0x7f0000001080)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000300)={0x2c, 0x12, 0x1, 0x70bd26, 0x25dfdbfe, "", [@nested={0x10, 0x0, 0x0, 0x0, [@typed={0xc, 0xce, 0x0, 0x0, @u64}]}, @nested={0xc, 0x35, 0x0, 0x1, [@typed={0x8, 0x68, 0x0, 0x0, @u32=0x2da6}]}]}, 0x2c}], 0x1, 0x0, 0x0, 0x4000}, 0x4000800)
openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x1e9100, 0x0)
syz_emit_vhci(&(0x7f0000001a40)=@HCI_EVENT_PKT={0x4, @hci_ev_auth_complete={{0x6, 0x3}, {0x0, 0xc9}}}, 0x6)
executing program 2:
getrandom(&(0x7f0000000240)=""/286, 0xffffff9a, 0x0)
r0 = syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3)
connect$bt_rfcomm(r0, &(0x7f00000003c0)={0x1f, @none, 0x8}, 0xa)
getsockopt$sock_buf(r0, 0x1, 0x1c, 0x0, &(0x7f0000004c00))
capget(&(0x7f00000000c0)={0x19980330}, &(0x7f0000000100)={0x4, 0xfffffff7, 0x4, 0x8, 0x6, 0xffff})
r1 = socket$inet6_tcp(0xa, 0x1, 0x0)
r2 = dup(r1)
ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x9af139be227d9862}})
ioctl$TIOCMIWAIT(r2, 0x545c, 0x0)
r3 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000000)=ANY=[@ANYBLOB="500100001a00330600000000fddbdf25fe8000000000000000000000000000aafe8000000000000000000000000000aa000040002c6c80050000800000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="fe8000000000000000000000000000bb000000003200000000000000000000000000000000000001230300000000000001000080000000000000000000000000c0000000000000000040000000000000000000000000000000000000000000000800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000029bd7000033500000a000500000000000000000048000200656362286369706865725f6e756c6c290000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000005002100020000000800280000000000080027"], 0x150}, 0x1, 0x0, 0x0, 0x4000}, 0x200080d4)
r4 = openat(0xffffffffffffffff, &(0x7f00000000c0)='./file1\x00', 0x281c2, 0x0)
r5 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$inet6_int(r5, 0x29, 0x35, &(0x7f0000000000)=0x7907, 0x4)
bind$inet6(r5, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x7ff, @empty, 0x9}, 0x1c)
recvmmsg(r5, &(0x7f0000000240)=[{{0x0, 0x0, 0x0}, 0x8}], 0x1, 0x2, 0x0)
sendto$inet6(r2, 0x0, 0x0, 0x20004184, &(0x7f0000000200)={0xa, 0x4e20, 0x0, @local}, 0x1c)
r6 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$inet_tcp_int(r6, 0x6, 0x210000000013, &(0x7f0000000040)=0x100000001, 0x4)
setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r4, 0x6, 0x14, &(0x7f0000000140)=0x2, 0x4)
getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r6, 0x6, 0x15, 0x0, &(0x7f0000001880))
fcntl$setlease(r4, 0x400, 0x1)
fcntl$getflags(r4, 0x401)
ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_CLIENT(r4, 0xc04c5349, &(0x7f0000000040)={0x1, 0xfc, 0x8})
r7 = socket$inet6_tcp(0xa, 0x1, 0x0)
r8 = syz_open_dev$ttys(0xc, 0x2, 0x0)
ioctl$GIO_CMAP(r8, 0x4b70, &(0x7f0000000000))
syz_usb_connect(0x0, 0x24, &(0x7f00000001c0)=ANY=[@ANYBLOB="12010000b5b30a40450c056055b5010203010902120001000000000904", @ANYRES64=r7], 0x0)
ioctl$TIOCGPTLCK(r8, 0x5420, &(0x7f0000001d40))
getsockopt$inet6_tcp_buf(r7, 0x6, 0x1a, 0x0, &(0x7f00000003c0))

program crashed: possible deadlock in l2cap_chan_connect
testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [10, 30]
detailed listing:
executing program 0:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) (async)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x1)
r2 = socket$netlink(0x10, 0x3, 0x0)
setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(r2, 0x10e, 0xc, &(0x7f0000000640)=0x7, 0x4) (async)
setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(r2, 0x10e, 0xc, &(0x7f0000000640)=0x7, 0x4)
sendmsg$netlink(r2, &(0x7f0000001080)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000300)={0x2c, 0x12, 0x1, 0x70bd26, 0x25dfdbfe, "", [@nested={0x10, 0x0, 0x0, 0x0, [@typed={0xc, 0xce, 0x0, 0x0, @u64}]}, @nested={0xc, 0x35, 0x0, 0x1, [@typed={0x8, 0x68, 0x0, 0x0, @u32=0x2da6}]}]}, 0x2c}], 0x1, 0x0, 0x0, 0x4000}, 0x4000800) (async)
sendmsg$netlink(r2, &(0x7f0000001080)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000300)={0x2c, 0x12, 0x1, 0x70bd26, 0x25dfdbfe, "", [@nested={0x10, 0x0, 0x0, 0x0, [@typed={0xc, 0xce, 0x0, 0x0, @u64}]}, @nested={0xc, 0x35, 0x0, 0x1, [@typed={0x8, 0x68, 0x0, 0x0, @u32=0x2da6}]}]}, 0x2c}], 0x1, 0x0, 0x0, 0x4000}, 0x4000800)
syz_emit_vhci(&(0x7f0000001a40)=@HCI_EVENT_PKT={0x4, @hci_ev_auth_complete={{0x6, 0x3}, {0x0, 0xc9}}}, 0x6)
executing program 2:
getrandom(&(0x7f0000000240)=""/286, 0xffffff9a, 0x0)
r0 = syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3)
connect$bt_rfcomm(r0, &(0x7f00000003c0)={0x1f, @none, 0x8}, 0xa)
getsockopt$sock_buf(r0, 0x1, 0x1c, 0x0, &(0x7f0000004c00))
capget(&(0x7f00000000c0)={0x19980330}, &(0x7f0000000100)={0x4, 0xfffffff7, 0x4, 0x8, 0x6, 0xffff})
r1 = socket$inet6_tcp(0xa, 0x1, 0x0)
r2 = dup(r1)
ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x9af139be227d9862}})
ioctl$TIOCMIWAIT(r2, 0x545c, 0x0)
r3 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000000)=ANY=[@ANYBLOB="500100001a00330600000000fddbdf25fe8000000000000000000000000000aafe8000000000000000000000000000aa000040002c6c80050000800000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="fe8000000000000000000000000000bb000000003200000000000000000000000000000000000001230300000000000001000080000000000000000000000000c0000000000000000040000000000000000000000000000000000000000000000800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000029bd7000033500000a000500000000000000000048000200656362286369706865725f6e756c6c290000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000005002100020000000800280000000000080027"], 0x150}, 0x1, 0x0, 0x0, 0x4000}, 0x200080d4)
r4 = openat(0xffffffffffffffff, &(0x7f00000000c0)='./file1\x00', 0x281c2, 0x0)
r5 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$inet6_int(r5, 0x29, 0x35, &(0x7f0000000000)=0x7907, 0x4)
bind$inet6(r5, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x7ff, @empty, 0x9}, 0x1c)
recvmmsg(r5, &(0x7f0000000240)=[{{0x0, 0x0, 0x0}, 0x8}], 0x1, 0x2, 0x0)
sendto$inet6(r2, 0x0, 0x0, 0x20004184, &(0x7f0000000200)={0xa, 0x4e20, 0x0, @local}, 0x1c)
r6 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$inet_tcp_int(r6, 0x6, 0x210000000013, &(0x7f0000000040)=0x100000001, 0x4)
setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r4, 0x6, 0x14, &(0x7f0000000140)=0x2, 0x4)
getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r6, 0x6, 0x15, 0x0, &(0x7f0000001880))
fcntl$setlease(r4, 0x400, 0x1)
fcntl$getflags(r4, 0x401)
ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_CLIENT(r4, 0xc04c5349, &(0x7f0000000040)={0x1, 0xfc, 0x8})
r7 = socket$inet6_tcp(0xa, 0x1, 0x0)
r8 = syz_open_dev$ttys(0xc, 0x2, 0x0)
ioctl$GIO_CMAP(r8, 0x4b70, &(0x7f0000000000))
syz_usb_connect(0x0, 0x24, &(0x7f00000001c0)=ANY=[@ANYBLOB="12010000b5b30a40450c056055b5010203010902120001000000000904", @ANYRES64=r7], 0x0)
ioctl$TIOCGPTLCK(r8, 0x5420, &(0x7f0000001d40))
getsockopt$inet6_tcp_buf(r7, 0x6, 0x1a, 0x0, &(0x7f00000003c0))

program crashed: possible deadlock in l2cap_chan_connect
testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [9, 30]
detailed listing:
executing program 0:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) (async)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x1)
r2 = socket$netlink(0x10, 0x3, 0x0)
setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(r2, 0x10e, 0xc, &(0x7f0000000640)=0x7, 0x4) (async)
setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(r2, 0x10e, 0xc, &(0x7f0000000640)=0x7, 0x4)
sendmsg$netlink(r2, &(0x7f0000001080)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000300)={0x2c, 0x12, 0x1, 0x70bd26, 0x25dfdbfe, "", [@nested={0x10, 0x0, 0x0, 0x0, [@typed={0xc, 0xce, 0x0, 0x0, @u64}]}, @nested={0xc, 0x35, 0x0, 0x1, [@typed={0x8, 0x68, 0x0, 0x0, @u32=0x2da6}]}]}, 0x2c}], 0x1, 0x0, 0x0, 0x4000}, 0x4000800) (async)
syz_emit_vhci(&(0x7f0000001a40)=@HCI_EVENT_PKT={0x4, @hci_ev_auth_complete={{0x6, 0x3}, {0x0, 0xc9}}}, 0x6)
executing program 2:
getrandom(&(0x7f0000000240)=""/286, 0xffffff9a, 0x0)
r0 = syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3)
connect$bt_rfcomm(r0, &(0x7f00000003c0)={0x1f, @none, 0x8}, 0xa)
getsockopt$sock_buf(r0, 0x1, 0x1c, 0x0, &(0x7f0000004c00))
capget(&(0x7f00000000c0)={0x19980330}, &(0x7f0000000100)={0x4, 0xfffffff7, 0x4, 0x8, 0x6, 0xffff})
r1 = socket$inet6_tcp(0xa, 0x1, 0x0)
r2 = dup(r1)
ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x9af139be227d9862}})
ioctl$TIOCMIWAIT(r2, 0x545c, 0x0)
r3 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000000)=ANY=[@ANYBLOB="500100001a00330600000000fddbdf25fe8000000000000000000000000000aafe8000000000000000000000000000aa000040002c6c80050000800000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="fe8000000000000000000000000000bb000000003200000000000000000000000000000000000001230300000000000001000080000000000000000000000000c0000000000000000040000000000000000000000000000000000000000000000800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000029bd7000033500000a000500000000000000000048000200656362286369706865725f6e756c6c290000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000005002100020000000800280000000000080027"], 0x150}, 0x1, 0x0, 0x0, 0x4000}, 0x200080d4)
r4 = openat(0xffffffffffffffff, &(0x7f00000000c0)='./file1\x00', 0x281c2, 0x0)
r5 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$inet6_int(r5, 0x29, 0x35, &(0x7f0000000000)=0x7907, 0x4)
bind$inet6(r5, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x7ff, @empty, 0x9}, 0x1c)
recvmmsg(r5, &(0x7f0000000240)=[{{0x0, 0x0, 0x0}, 0x8}], 0x1, 0x2, 0x0)
sendto$inet6(r2, 0x0, 0x0, 0x20004184, &(0x7f0000000200)={0xa, 0x4e20, 0x0, @local}, 0x1c)
r6 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$inet_tcp_int(r6, 0x6, 0x210000000013, &(0x7f0000000040)=0x100000001, 0x4)
setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r4, 0x6, 0x14, &(0x7f0000000140)=0x2, 0x4)
getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r6, 0x6, 0x15, 0x0, &(0x7f0000001880))
fcntl$setlease(r4, 0x400, 0x1)
fcntl$getflags(r4, 0x401)
ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_CLIENT(r4, 0xc04c5349, &(0x7f0000000040)={0x1, 0xfc, 0x8})
r7 = socket$inet6_tcp(0xa, 0x1, 0x0)
r8 = syz_open_dev$ttys(0xc, 0x2, 0x0)
ioctl$GIO_CMAP(r8, 0x4b70, &(0x7f0000000000))
syz_usb_connect(0x0, 0x24, &(0x7f00000001c0)=ANY=[@ANYBLOB="12010000b5b30a40450c056055b5010203010902120001000000000904", @ANYRES64=r7], 0x0)
ioctl$TIOCGPTLCK(r8, 0x5420, &(0x7f0000001d40))
getsockopt$inet6_tcp_buf(r7, 0x6, 0x1a, 0x0, &(0x7f00000003c0))

program crashed: possible deadlock in rfcomm_security_cfm
testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [8, 30]
detailed listing:
executing program 0:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) (async)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x1)
r2 = socket$netlink(0x10, 0x3, 0x0)
setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(r2, 0x10e, 0xc, &(0x7f0000000640)=0x7, 0x4) (async)
setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(r2, 0x10e, 0xc, &(0x7f0000000640)=0x7, 0x4)
syz_emit_vhci(&(0x7f0000001a40)=@HCI_EVENT_PKT={0x4, @hci_ev_auth_complete={{0x6, 0x3}, {0x0, 0xc9}}}, 0x6)
executing program 2:
getrandom(&(0x7f0000000240)=""/286, 0xffffff9a, 0x0)
r0 = syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3)
connect$bt_rfcomm(r0, &(0x7f00000003c0)={0x1f, @none, 0x8}, 0xa)
getsockopt$sock_buf(r0, 0x1, 0x1c, 0x0, &(0x7f0000004c00))
capget(&(0x7f00000000c0)={0x19980330}, &(0x7f0000000100)={0x4, 0xfffffff7, 0x4, 0x8, 0x6, 0xffff})
r1 = socket$inet6_tcp(0xa, 0x1, 0x0)
r2 = dup(r1)
ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x9af139be227d9862}})
ioctl$TIOCMIWAIT(r2, 0x545c, 0x0)
r3 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000000)=ANY=[@ANYBLOB="500100001a00330600000000fddbdf25fe8000000000000000000000000000aafe8000000000000000000000000000aa000040002c6c80050000800000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="fe8000000000000000000000000000bb000000003200000000000000000000000000000000000001230300000000000001000080000000000000000000000000c0000000000000000040000000000000000000000000000000000000000000000800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000029bd7000033500000a000500000000000000000048000200656362286369706865725f6e756c6c290000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000005002100020000000800280000000000080027"], 0x150}, 0x1, 0x0, 0x0, 0x4000}, 0x200080d4)
r4 = openat(0xffffffffffffffff, &(0x7f00000000c0)='./file1\x00', 0x281c2, 0x0)
r5 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$inet6_int(r5, 0x29, 0x35, &(0x7f0000000000)=0x7907, 0x4)
bind$inet6(r5, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x7ff, @empty, 0x9}, 0x1c)
recvmmsg(r5, &(0x7f0000000240)=[{{0x0, 0x0, 0x0}, 0x8}], 0x1, 0x2, 0x0)
sendto$inet6(r2, 0x0, 0x0, 0x20004184, &(0x7f0000000200)={0xa, 0x4e20, 0x0, @local}, 0x1c)
r6 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$inet_tcp_int(r6, 0x6, 0x210000000013, &(0x7f0000000040)=0x100000001, 0x4)
setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r4, 0x6, 0x14, &(0x7f0000000140)=0x2, 0x4)
getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r6, 0x6, 0x15, 0x0, &(0x7f0000001880))
fcntl$setlease(r4, 0x400, 0x1)
fcntl$getflags(r4, 0x401)
ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_CLIENT(r4, 0xc04c5349, &(0x7f0000000040)={0x1, 0xfc, 0x8})
r7 = socket$inet6_tcp(0xa, 0x1, 0x0)
r8 = syz_open_dev$ttys(0xc, 0x2, 0x0)
ioctl$GIO_CMAP(r8, 0x4b70, &(0x7f0000000000))
syz_usb_connect(0x0, 0x24, &(0x7f00000001c0)=ANY=[@ANYBLOB="12010000b5b30a40450c056055b5010203010902120001000000000904", @ANYRES64=r7], 0x0)
ioctl$TIOCGPTLCK(r8, 0x5420, &(0x7f0000001d40))
getsockopt$inet6_tcp_buf(r7, 0x6, 0x1a, 0x0, &(0x7f00000003c0))

program crashed: possible deadlock in l2cap_chan_connect
testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [7, 30]
detailed listing:
executing program 0:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) (async)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x1)
r2 = socket$netlink(0x10, 0x3, 0x0)
setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(r2, 0x10e, 0xc, &(0x7f0000000640)=0x7, 0x4) (async)
syz_emit_vhci(&(0x7f0000001a40)=@HCI_EVENT_PKT={0x4, @hci_ev_auth_complete={{0x6, 0x3}, {0x0, 0xc9}}}, 0x6)
executing program 2:
getrandom(&(0x7f0000000240)=""/286, 0xffffff9a, 0x0)
r0 = syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3)
connect$bt_rfcomm(r0, &(0x7f00000003c0)={0x1f, @none, 0x8}, 0xa)
getsockopt$sock_buf(r0, 0x1, 0x1c, 0x0, &(0x7f0000004c00))
capget(&(0x7f00000000c0)={0x19980330}, &(0x7f0000000100)={0x4, 0xfffffff7, 0x4, 0x8, 0x6, 0xffff})
r1 = socket$inet6_tcp(0xa, 0x1, 0x0)
r2 = dup(r1)
ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x9af139be227d9862}})
ioctl$TIOCMIWAIT(r2, 0x545c, 0x0)
r3 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000000)=ANY=[@ANYBLOB="500100001a00330600000000fddbdf25fe8000000000000000000000000000aafe8000000000000000000000000000aa000040002c6c80050000800000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="fe8000000000000000000000000000bb000000003200000000000000000000000000000000000001230300000000000001000080000000000000000000000000c0000000000000000040000000000000000000000000000000000000000000000800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000029bd7000033500000a000500000000000000000048000200656362286369706865725f6e756c6c290000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000005002100020000000800280000000000080027"], 0x150}, 0x1, 0x0, 0x0, 0x4000}, 0x200080d4)
r4 = openat(0xffffffffffffffff, &(0x7f00000000c0)='./file1\x00', 0x281c2, 0x0)
r5 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$inet6_int(r5, 0x29, 0x35, &(0x7f0000000000)=0x7907, 0x4)
bind$inet6(r5, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x7ff, @empty, 0x9}, 0x1c)
recvmmsg(r5, &(0x7f0000000240)=[{{0x0, 0x0, 0x0}, 0x8}], 0x1, 0x2, 0x0)
sendto$inet6(r2, 0x0, 0x0, 0x20004184, &(0x7f0000000200)={0xa, 0x4e20, 0x0, @local}, 0x1c)
r6 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$inet_tcp_int(r6, 0x6, 0x210000000013, &(0x7f0000000040)=0x100000001, 0x4)
setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r4, 0x6, 0x14, &(0x7f0000000140)=0x2, 0x4)
getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r6, 0x6, 0x15, 0x0, &(0x7f0000001880))
fcntl$setlease(r4, 0x400, 0x1)
fcntl$getflags(r4, 0x401)
ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_CLIENT(r4, 0xc04c5349, &(0x7f0000000040)={0x1, 0xfc, 0x8})
r7 = socket$inet6_tcp(0xa, 0x1, 0x0)
r8 = syz_open_dev$ttys(0xc, 0x2, 0x0)
ioctl$GIO_CMAP(r8, 0x4b70, &(0x7f0000000000))
syz_usb_connect(0x0, 0x24, &(0x7f00000001c0)=ANY=[@ANYBLOB="12010000b5b30a40450c056055b5010203010902120001000000000904", @ANYRES64=r7], 0x0)
ioctl$TIOCGPTLCK(r8, 0x5420, &(0x7f0000001d40))
getsockopt$inet6_tcp_buf(r7, 0x6, 0x1a, 0x0, &(0x7f00000003c0))

program crashed: possible deadlock in rfcomm_security_cfm
testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [6, 30]
detailed listing:
executing program 0:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) (async)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x1)
socket$netlink(0x10, 0x3, 0x0)
syz_emit_vhci(&(0x7f0000001a40)=@HCI_EVENT_PKT={0x4, @hci_ev_auth_complete={{0x6, 0x3}, {0x0, 0xc9}}}, 0x6)
executing program 2:
getrandom(&(0x7f0000000240)=""/286, 0xffffff9a, 0x0)
r0 = syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3)
connect$bt_rfcomm(r0, &(0x7f00000003c0)={0x1f, @none, 0x8}, 0xa)
getsockopt$sock_buf(r0, 0x1, 0x1c, 0x0, &(0x7f0000004c00))
capget(&(0x7f00000000c0)={0x19980330}, &(0x7f0000000100)={0x4, 0xfffffff7, 0x4, 0x8, 0x6, 0xffff})
r1 = socket$inet6_tcp(0xa, 0x1, 0x0)
r2 = dup(r1)
ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x9af139be227d9862}})
ioctl$TIOCMIWAIT(r2, 0x545c, 0x0)
r3 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000000)=ANY=[@ANYBLOB="500100001a00330600000000fddbdf25fe8000000000000000000000000000aafe8000000000000000000000000000aa000040002c6c80050000800000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="fe8000000000000000000000000000bb000000003200000000000000000000000000000000000001230300000000000001000080000000000000000000000000c0000000000000000040000000000000000000000000000000000000000000000800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000029bd7000033500000a000500000000000000000048000200656362286369706865725f6e756c6c290000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000005002100020000000800280000000000080027"], 0x150}, 0x1, 0x0, 0x0, 0x4000}, 0x200080d4)
r4 = openat(0xffffffffffffffff, &(0x7f00000000c0)='./file1\x00', 0x281c2, 0x0)
r5 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$inet6_int(r5, 0x29, 0x35, &(0x7f0000000000)=0x7907, 0x4)
bind$inet6(r5, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x7ff, @empty, 0x9}, 0x1c)
recvmmsg(r5, &(0x7f0000000240)=[{{0x0, 0x0, 0x0}, 0x8}], 0x1, 0x2, 0x0)
sendto$inet6(r2, 0x0, 0x0, 0x20004184, &(0x7f0000000200)={0xa, 0x4e20, 0x0, @local}, 0x1c)
r6 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$inet_tcp_int(r6, 0x6, 0x210000000013, &(0x7f0000000040)=0x100000001, 0x4)
setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r4, 0x6, 0x14, &(0x7f0000000140)=0x2, 0x4)
getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r6, 0x6, 0x15, 0x0, &(0x7f0000001880))
fcntl$setlease(r4, 0x400, 0x1)
fcntl$getflags(r4, 0x401)
ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_CLIENT(r4, 0xc04c5349, &(0x7f0000000040)={0x1, 0xfc, 0x8})
r7 = socket$inet6_tcp(0xa, 0x1, 0x0)
r8 = syz_open_dev$ttys(0xc, 0x2, 0x0)
ioctl$GIO_CMAP(r8, 0x4b70, &(0x7f0000000000))
syz_usb_connect(0x0, 0x24, &(0x7f00000001c0)=ANY=[@ANYBLOB="12010000b5b30a40450c056055b5010203010902120001000000000904", @ANYRES64=r7], 0x0)
ioctl$TIOCGPTLCK(r8, 0x5420, &(0x7f0000001d40))
getsockopt$inet6_tcp_buf(r7, 0x6, 0x1a, 0x0, &(0x7f00000003c0))

program crashed: possible deadlock in l2cap_chan_connect
testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [5, 30]
detailed listing:
executing program 0:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) (async)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x1)
syz_emit_vhci(&(0x7f0000001a40)=@HCI_EVENT_PKT={0x4, @hci_ev_auth_complete={{0x6, 0x3}, {0x0, 0xc9}}}, 0x6)
executing program 2:
getrandom(&(0x7f0000000240)=""/286, 0xffffff9a, 0x0)
r0 = syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3)
connect$bt_rfcomm(r0, &(0x7f00000003c0)={0x1f, @none, 0x8}, 0xa)
getsockopt$sock_buf(r0, 0x1, 0x1c, 0x0, &(0x7f0000004c00))
capget(&(0x7f00000000c0)={0x19980330}, &(0x7f0000000100)={0x4, 0xfffffff7, 0x4, 0x8, 0x6, 0xffff})
r1 = socket$inet6_tcp(0xa, 0x1, 0x0)
r2 = dup(r1)
ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x9af139be227d9862}})
ioctl$TIOCMIWAIT(r2, 0x545c, 0x0)
r3 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000000)=ANY=[@ANYBLOB="500100001a00330600000000fddbdf25fe8000000000000000000000000000aafe8000000000000000000000000000aa000040002c6c80050000800000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="fe8000000000000000000000000000bb000000003200000000000000000000000000000000000001230300000000000001000080000000000000000000000000c0000000000000000040000000000000000000000000000000000000000000000800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000029bd7000033500000a000500000000000000000048000200656362286369706865725f6e756c6c290000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000005002100020000000800280000000000080027"], 0x150}, 0x1, 0x0, 0x0, 0x4000}, 0x200080d4)
r4 = openat(0xffffffffffffffff, &(0x7f00000000c0)='./file1\x00', 0x281c2, 0x0)
r5 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$inet6_int(r5, 0x29, 0x35, &(0x7f0000000000)=0x7907, 0x4)
bind$inet6(r5, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x7ff, @empty, 0x9}, 0x1c)
recvmmsg(r5, &(0x7f0000000240)=[{{0x0, 0x0, 0x0}, 0x8}], 0x1, 0x2, 0x0)
sendto$inet6(r2, 0x0, 0x0, 0x20004184, &(0x7f0000000200)={0xa, 0x4e20, 0x0, @local}, 0x1c)
r6 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$inet_tcp_int(r6, 0x6, 0x210000000013, &(0x7f0000000040)=0x100000001, 0x4)
setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r4, 0x6, 0x14, &(0x7f0000000140)=0x2, 0x4)
getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r6, 0x6, 0x15, 0x0, &(0x7f0000001880))
fcntl$setlease(r4, 0x400, 0x1)
fcntl$getflags(r4, 0x401)
ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_CLIENT(r4, 0xc04c5349, &(0x7f0000000040)={0x1, 0xfc, 0x8})
r7 = socket$inet6_tcp(0xa, 0x1, 0x0)
r8 = syz_open_dev$ttys(0xc, 0x2, 0x0)
ioctl$GIO_CMAP(r8, 0x4b70, &(0x7f0000000000))
syz_usb_connect(0x0, 0x24, &(0x7f00000001c0)=ANY=[@ANYBLOB="12010000b5b30a40450c056055b5010203010902120001000000000904", @ANYRES64=r7], 0x0)
ioctl$TIOCGPTLCK(r8, 0x5420, &(0x7f0000001d40))
getsockopt$inet6_tcp_buf(r7, 0x6, 0x1a, 0x0, &(0x7f00000003c0))

program crashed: possible deadlock in l2cap_chan_connect
testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [4, 30]
detailed listing:
executing program 0:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) (async)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
syz_emit_vhci(&(0x7f0000001a40)=@HCI_EVENT_PKT={0x4, @hci_ev_auth_complete={{0x6, 0x3}, {0x0, 0xc9}}}, 0x6)
executing program 2:
getrandom(&(0x7f0000000240)=""/286, 0xffffff9a, 0x0)
r0 = syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3)
connect$bt_rfcomm(r0, &(0x7f00000003c0)={0x1f, @none, 0x8}, 0xa)
getsockopt$sock_buf(r0, 0x1, 0x1c, 0x0, &(0x7f0000004c00))
capget(&(0x7f00000000c0)={0x19980330}, &(0x7f0000000100)={0x4, 0xfffffff7, 0x4, 0x8, 0x6, 0xffff})
r1 = socket$inet6_tcp(0xa, 0x1, 0x0)
r2 = dup(r1)
ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x9af139be227d9862}})
ioctl$TIOCMIWAIT(r2, 0x545c, 0x0)
r3 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000000)=ANY=[@ANYBLOB="500100001a00330600000000fddbdf25fe8000000000000000000000000000aafe8000000000000000000000000000aa000040002c6c80050000800000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="fe8000000000000000000000000000bb000000003200000000000000000000000000000000000001230300000000000001000080000000000000000000000000c0000000000000000040000000000000000000000000000000000000000000000800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000029bd7000033500000a000500000000000000000048000200656362286369706865725f6e756c6c290000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000005002100020000000800280000000000080027"], 0x150}, 0x1, 0x0, 0x0, 0x4000}, 0x200080d4)
r4 = openat(0xffffffffffffffff, &(0x7f00000000c0)='./file1\x00', 0x281c2, 0x0)
r5 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$inet6_int(r5, 0x29, 0x35, &(0x7f0000000000)=0x7907, 0x4)
bind$inet6(r5, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x7ff, @empty, 0x9}, 0x1c)
recvmmsg(r5, &(0x7f0000000240)=[{{0x0, 0x0, 0x0}, 0x8}], 0x1, 0x2, 0x0)
sendto$inet6(r2, 0x0, 0x0, 0x20004184, &(0x7f0000000200)={0xa, 0x4e20, 0x0, @local}, 0x1c)
r6 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$inet_tcp_int(r6, 0x6, 0x210000000013, &(0x7f0000000040)=0x100000001, 0x4)
setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r4, 0x6, 0x14, &(0x7f0000000140)=0x2, 0x4)
getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r6, 0x6, 0x15, 0x0, &(0x7f0000001880))
fcntl$setlease(r4, 0x400, 0x1)
fcntl$getflags(r4, 0x401)
ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_CLIENT(r4, 0xc04c5349, &(0x7f0000000040)={0x1, 0xfc, 0x8})
r7 = socket$inet6_tcp(0xa, 0x1, 0x0)
r8 = syz_open_dev$ttys(0xc, 0x2, 0x0)
ioctl$GIO_CMAP(r8, 0x4b70, &(0x7f0000000000))
syz_usb_connect(0x0, 0x24, &(0x7f00000001c0)=ANY=[@ANYBLOB="12010000b5b30a40450c056055b5010203010902120001000000000904", @ANYRES64=r7], 0x0)
ioctl$TIOCGPTLCK(r8, 0x5420, &(0x7f0000001d40))
getsockopt$inet6_tcp_buf(r7, 0x6, 0x1a, 0x0, &(0x7f00000003c0))

program crashed: possible deadlock in rfcomm_security_cfm
testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [3, 30]
detailed listing:
executing program 0:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) (async)
syz_emit_vhci(&(0x7f0000001a40)=@HCI_EVENT_PKT={0x4, @hci_ev_auth_complete={{0x6, 0x3}, {0x0, 0xc9}}}, 0x6)
executing program 2:
getrandom(&(0x7f0000000240)=""/286, 0xffffff9a, 0x0)
r0 = syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3)
connect$bt_rfcomm(r0, &(0x7f00000003c0)={0x1f, @none, 0x8}, 0xa)
getsockopt$sock_buf(r0, 0x1, 0x1c, 0x0, &(0x7f0000004c00))
capget(&(0x7f00000000c0)={0x19980330}, &(0x7f0000000100)={0x4, 0xfffffff7, 0x4, 0x8, 0x6, 0xffff})
r1 = socket$inet6_tcp(0xa, 0x1, 0x0)
r2 = dup(r1)
ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x9af139be227d9862}})
ioctl$TIOCMIWAIT(r2, 0x545c, 0x0)
r3 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000000)=ANY=[@ANYBLOB="500100001a00330600000000fddbdf25fe8000000000000000000000000000aafe8000000000000000000000000000aa000040002c6c80050000800000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="fe8000000000000000000000000000bb000000003200000000000000000000000000000000000001230300000000000001000080000000000000000000000000c0000000000000000040000000000000000000000000000000000000000000000800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000029bd7000033500000a000500000000000000000048000200656362286369706865725f6e756c6c290000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000005002100020000000800280000000000080027"], 0x150}, 0x1, 0x0, 0x0, 0x4000}, 0x200080d4)
r4 = openat(0xffffffffffffffff, &(0x7f00000000c0)='./file1\x00', 0x281c2, 0x0)
r5 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$inet6_int(r5, 0x29, 0x35, &(0x7f0000000000)=0x7907, 0x4)
bind$inet6(r5, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x7ff, @empty, 0x9}, 0x1c)
recvmmsg(r5, &(0x7f0000000240)=[{{0x0, 0x0, 0x0}, 0x8}], 0x1, 0x2, 0x0)
sendto$inet6(r2, 0x0, 0x0, 0x20004184, &(0x7f0000000200)={0xa, 0x4e20, 0x0, @local}, 0x1c)
r6 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$inet_tcp_int(r6, 0x6, 0x210000000013, &(0x7f0000000040)=0x100000001, 0x4)
setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r4, 0x6, 0x14, &(0x7f0000000140)=0x2, 0x4)
getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r6, 0x6, 0x15, 0x0, &(0x7f0000001880))
fcntl$setlease(r4, 0x400, 0x1)
fcntl$getflags(r4, 0x401)
ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_CLIENT(r4, 0xc04c5349, &(0x7f0000000040)={0x1, 0xfc, 0x8})
r7 = socket$inet6_tcp(0xa, 0x1, 0x0)
r8 = syz_open_dev$ttys(0xc, 0x2, 0x0)
ioctl$GIO_CMAP(r8, 0x4b70, &(0x7f0000000000))
syz_usb_connect(0x0, 0x24, &(0x7f00000001c0)=ANY=[@ANYBLOB="12010000b5b30a40450c056055b5010203010902120001000000000904", @ANYRES64=r7], 0x0)
ioctl$TIOCGPTLCK(r8, 0x5420, &(0x7f0000001d40))
getsockopt$inet6_tcp_buf(r7, 0x6, 0x1a, 0x0, &(0x7f00000003c0))

program crashed: possible deadlock in l2cap_chan_connect
testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [2, 30]
detailed listing:
executing program 0:
openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
syz_emit_vhci(&(0x7f0000001a40)=@HCI_EVENT_PKT={0x4, @hci_ev_auth_complete={{0x6, 0x3}, {0x0, 0xc9}}}, 0x6)
executing program 2:
getrandom(&(0x7f0000000240)=""/286, 0xffffff9a, 0x0)
r0 = syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3)
connect$bt_rfcomm(r0, &(0x7f00000003c0)={0x1f, @none, 0x8}, 0xa)
getsockopt$sock_buf(r0, 0x1, 0x1c, 0x0, &(0x7f0000004c00))
capget(&(0x7f00000000c0)={0x19980330}, &(0x7f0000000100)={0x4, 0xfffffff7, 0x4, 0x8, 0x6, 0xffff})
r1 = socket$inet6_tcp(0xa, 0x1, 0x0)
r2 = dup(r1)
ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x9af139be227d9862}})
ioctl$TIOCMIWAIT(r2, 0x545c, 0x0)
r3 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000000)=ANY=[@ANYBLOB="500100001a00330600000000fddbdf25fe8000000000000000000000000000aafe8000000000000000000000000000aa000040002c6c80050000800000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="fe8000000000000000000000000000bb000000003200000000000000000000000000000000000001230300000000000001000080000000000000000000000000c0000000000000000040000000000000000000000000000000000000000000000800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000029bd7000033500000a000500000000000000000048000200656362286369706865725f6e756c6c290000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000005002100020000000800280000000000080027"], 0x150}, 0x1, 0x0, 0x0, 0x4000}, 0x200080d4)
r4 = openat(0xffffffffffffffff, &(0x7f00000000c0)='./file1\x00', 0x281c2, 0x0)
r5 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$inet6_int(r5, 0x29, 0x35, &(0x7f0000000000)=0x7907, 0x4)
bind$inet6(r5, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x7ff, @empty, 0x9}, 0x1c)
recvmmsg(r5, &(0x7f0000000240)=[{{0x0, 0x0, 0x0}, 0x8}], 0x1, 0x2, 0x0)
sendto$inet6(r2, 0x0, 0x0, 0x20004184, &(0x7f0000000200)={0xa, 0x4e20, 0x0, @local}, 0x1c)
r6 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$inet_tcp_int(r6, 0x6, 0x210000000013, &(0x7f0000000040)=0x100000001, 0x4)
setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r4, 0x6, 0x14, &(0x7f0000000140)=0x2, 0x4)
getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r6, 0x6, 0x15, 0x0, &(0x7f0000001880))
fcntl$setlease(r4, 0x400, 0x1)
fcntl$getflags(r4, 0x401)
ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_CLIENT(r4, 0xc04c5349, &(0x7f0000000040)={0x1, 0xfc, 0x8})
r7 = socket$inet6_tcp(0xa, 0x1, 0x0)
r8 = syz_open_dev$ttys(0xc, 0x2, 0x0)
ioctl$GIO_CMAP(r8, 0x4b70, &(0x7f0000000000))
syz_usb_connect(0x0, 0x24, &(0x7f00000001c0)=ANY=[@ANYBLOB="12010000b5b30a40450c056055b5010203010902120001000000000904", @ANYRES64=r7], 0x0)
ioctl$TIOCGPTLCK(r8, 0x5420, &(0x7f0000001d40))
getsockopt$inet6_tcp_buf(r7, 0x6, 0x1a, 0x0, &(0x7f00000003c0))

program crashed: possible deadlock in l2cap_chan_connect
testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [1, 30]
detailed listing:
executing program 0:
syz_emit_vhci(&(0x7f0000001a40)=@HCI_EVENT_PKT={0x4, @hci_ev_auth_complete={{0x6, 0x3}, {0x0, 0xc9}}}, 0x6)
executing program 2:
getrandom(&(0x7f0000000240)=""/286, 0xffffff9a, 0x0)
r0 = syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3)
connect$bt_rfcomm(r0, &(0x7f00000003c0)={0x1f, @none, 0x8}, 0xa)
getsockopt$sock_buf(r0, 0x1, 0x1c, 0x0, &(0x7f0000004c00))
capget(&(0x7f00000000c0)={0x19980330}, &(0x7f0000000100)={0x4, 0xfffffff7, 0x4, 0x8, 0x6, 0xffff})
r1 = socket$inet6_tcp(0xa, 0x1, 0x0)
r2 = dup(r1)
ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x9af139be227d9862}})
ioctl$TIOCMIWAIT(r2, 0x545c, 0x0)
r3 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000000)=ANY=[@ANYBLOB="500100001a00330600000000fddbdf25fe8000000000000000000000000000aafe8000000000000000000000000000aa000040002c6c80050000800000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="fe8000000000000000000000000000bb000000003200000000000000000000000000000000000001230300000000000001000080000000000000000000000000c0000000000000000040000000000000000000000000000000000000000000000800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000029bd7000033500000a000500000000000000000048000200656362286369706865725f6e756c6c290000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000005002100020000000800280000000000080027"], 0x150}, 0x1, 0x0, 0x0, 0x4000}, 0x200080d4)
r4 = openat(0xffffffffffffffff, &(0x7f00000000c0)='./file1\x00', 0x281c2, 0x0)
r5 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$inet6_int(r5, 0x29, 0x35, &(0x7f0000000000)=0x7907, 0x4)
bind$inet6(r5, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x7ff, @empty, 0x9}, 0x1c)
recvmmsg(r5, &(0x7f0000000240)=[{{0x0, 0x0, 0x0}, 0x8}], 0x1, 0x2, 0x0)
sendto$inet6(r2, 0x0, 0x0, 0x20004184, &(0x7f0000000200)={0xa, 0x4e20, 0x0, @local}, 0x1c)
r6 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$inet_tcp_int(r6, 0x6, 0x210000000013, &(0x7f0000000040)=0x100000001, 0x4)
setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r4, 0x6, 0x14, &(0x7f0000000140)=0x2, 0x4)
getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r6, 0x6, 0x15, 0x0, &(0x7f0000001880))
fcntl$setlease(r4, 0x400, 0x1)
fcntl$getflags(r4, 0x401)
ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_CLIENT(r4, 0xc04c5349, &(0x7f0000000040)={0x1, 0xfc, 0x8})
r7 = socket$inet6_tcp(0xa, 0x1, 0x0)
r8 = syz_open_dev$ttys(0xc, 0x2, 0x0)
ioctl$GIO_CMAP(r8, 0x4b70, &(0x7f0000000000))
syz_usb_connect(0x0, 0x24, &(0x7f00000001c0)=ANY=[@ANYBLOB="12010000b5b30a40450c056055b5010203010902120001000000000904", @ANYRES64=r7], 0x0)
ioctl$TIOCGPTLCK(r8, 0x5420, &(0x7f0000001d40))
getsockopt$inet6_tcp_buf(r7, 0x6, 0x1a, 0x0, &(0x7f00000003c0))

program crashed: possible deadlock in l2cap_chan_connect
minimized 29 calls -> 1 calls
minimizing program #1 before concatenation
testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [1, 29]
detailed listing:
executing program 1:
syz_emit_vhci(&(0x7f0000001a40)=@HCI_EVENT_PKT={0x4, @hci_ev_auth_complete={{0x6, 0x3}, {0x0, 0xc9}}}, 0x6)
executing program 0:
getrandom(&(0x7f0000000240)=""/286, 0xffffff9a, 0x0)
r0 = syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3)
connect$bt_rfcomm(r0, &(0x7f00000003c0)={0x1f, @none, 0x8}, 0xa)
getsockopt$sock_buf(r0, 0x1, 0x1c, 0x0, &(0x7f0000004c00))
capget(&(0x7f00000000c0)={0x19980330}, &(0x7f0000000100)={0x4, 0xfffffff7, 0x4, 0x8, 0x6, 0xffff})
r1 = socket$inet6_tcp(0xa, 0x1, 0x0)
r2 = dup(r1)
ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x9af139be227d9862}})
ioctl$TIOCMIWAIT(r2, 0x545c, 0x0)
r3 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000000)=ANY=[@ANYBLOB="500100001a00330600000000fddbdf25fe8000000000000000000000000000aafe8000000000000000000000000000aa000040002c6c80050000800000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="fe8000000000000000000000000000bb000000003200000000000000000000000000000000000001230300000000000001000080000000000000000000000000c0000000000000000040000000000000000000000000000000000000000000000800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000029bd7000033500000a000500000000000000000048000200656362286369706865725f6e756c6c290000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000005002100020000000800280000000000080027"], 0x150}, 0x1, 0x0, 0x0, 0x4000}, 0x200080d4)
r4 = openat(0xffffffffffffffff, &(0x7f00000000c0)='./file1\x00', 0x281c2, 0x0)
r5 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$inet6_int(r5, 0x29, 0x35, &(0x7f0000000000)=0x7907, 0x4)
bind$inet6(r5, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x7ff, @empty, 0x9}, 0x1c)
recvmmsg(r5, &(0x7f0000000240)=[{{0x0, 0x0, 0x0}, 0x8}], 0x1, 0x2, 0x0)
sendto$inet6(r2, 0x0, 0x0, 0x20004184, &(0x7f0000000200)={0xa, 0x4e20, 0x0, @local}, 0x1c)
r6 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$inet_tcp_int(r6, 0x6, 0x210000000013, &(0x7f0000000040)=0x100000001, 0x4)
setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r4, 0x6, 0x14, &(0x7f0000000140)=0x2, 0x4)
getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r6, 0x6, 0x15, 0x0, &(0x7f0000001880))
fcntl$setlease(r4, 0x400, 0x1)
fcntl$getflags(r4, 0x401)
ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_CLIENT(r4, 0xc04c5349, &(0x7f0000000040)={0x1, 0xfc, 0x8})
r7 = socket$inet6_tcp(0xa, 0x1, 0x0)
r8 = syz_open_dev$ttys(0xc, 0x2, 0x0)
ioctl$GIO_CMAP(r8, 0x4b70, &(0x7f0000000000))
syz_usb_connect(0x0, 0x24, &(0x7f00000001c0)=ANY=[@ANYBLOB="12010000b5b30a40450c056055b5010203010902120001000000000904", @ANYRES64=r7], 0x0)
ioctl$TIOCGPTLCK(r8, 0x5420, &(0x7f0000001d40))

program crashed: possible deadlock in l2cap_chan_connect
testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [1, 28]
detailed listing:
executing program 1:
syz_emit_vhci(&(0x7f0000001a40)=@HCI_EVENT_PKT={0x4, @hci_ev_auth_complete={{0x6, 0x3}, {0x0, 0xc9}}}, 0x6)
executing program 0:
getrandom(&(0x7f0000000240)=""/286, 0xffffff9a, 0x0)
r0 = syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3)
connect$bt_rfcomm(r0, &(0x7f00000003c0)={0x1f, @none, 0x8}, 0xa)
getsockopt$sock_buf(r0, 0x1, 0x1c, 0x0, &(0x7f0000004c00))
capget(&(0x7f00000000c0)={0x19980330}, &(0x7f0000000100)={0x4, 0xfffffff7, 0x4, 0x8, 0x6, 0xffff})
r1 = socket$inet6_tcp(0xa, 0x1, 0x0)
r2 = dup(r1)
ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x9af139be227d9862}})
ioctl$TIOCMIWAIT(r2, 0x545c, 0x0)
r3 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000000)=ANY=[@ANYBLOB="500100001a00330600000000fddbdf25fe8000000000000000000000000000aafe8000000000000000000000000000aa000040002c6c80050000800000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="fe8000000000000000000000000000bb000000003200000000000000000000000000000000000001230300000000000001000080000000000000000000000000c0000000000000000040000000000000000000000000000000000000000000000800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000029bd7000033500000a000500000000000000000048000200656362286369706865725f6e756c6c290000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000005002100020000000800280000000000080027"], 0x150}, 0x1, 0x0, 0x0, 0x4000}, 0x200080d4)
r4 = openat(0xffffffffffffffff, &(0x7f00000000c0)='./file1\x00', 0x281c2, 0x0)
r5 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$inet6_int(r5, 0x29, 0x35, &(0x7f0000000000)=0x7907, 0x4)
bind$inet6(r5, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x7ff, @empty, 0x9}, 0x1c)
recvmmsg(r5, &(0x7f0000000240)=[{{0x0, 0x0, 0x0}, 0x8}], 0x1, 0x2, 0x0)
sendto$inet6(r2, 0x0, 0x0, 0x20004184, &(0x7f0000000200)={0xa, 0x4e20, 0x0, @local}, 0x1c)
r6 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$inet_tcp_int(r6, 0x6, 0x210000000013, &(0x7f0000000040)=0x100000001, 0x4)
setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r4, 0x6, 0x14, &(0x7f0000000140)=0x2, 0x4)
getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r6, 0x6, 0x15, 0x0, &(0x7f0000001880))
fcntl$setlease(r4, 0x400, 0x1)
fcntl$getflags(r4, 0x401)
ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_CLIENT(r4, 0xc04c5349, &(0x7f0000000040)={0x1, 0xfc, 0x8})
r7 = socket$inet6_tcp(0xa, 0x1, 0x0)
r8 = syz_open_dev$ttys(0xc, 0x2, 0x0)
ioctl$GIO_CMAP(r8, 0x4b70, &(0x7f0000000000))
syz_usb_connect(0x0, 0x24, &(0x7f00000001c0)=ANY=[@ANYBLOB="12010000b5b30a40450c056055b5010203010902120001000000000904", @ANYRES64=r7], 0x0)

program crashed: possible deadlock in l2cap_chan_connect
testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [1, 27]
detailed listing:
executing program 1:
syz_emit_vhci(&(0x7f0000001a40)=@HCI_EVENT_PKT={0x4, @hci_ev_auth_complete={{0x6, 0x3}, {0x0, 0xc9}}}, 0x6)
executing program 0:
getrandom(&(0x7f0000000240)=""/286, 0xffffff9a, 0x0)
r0 = syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3)
connect$bt_rfcomm(r0, &(0x7f00000003c0)={0x1f, @none, 0x8}, 0xa)
getsockopt$sock_buf(r0, 0x1, 0x1c, 0x0, &(0x7f0000004c00))
capget(&(0x7f00000000c0)={0x19980330}, &(0x7f0000000100)={0x4, 0xfffffff7, 0x4, 0x8, 0x6, 0xffff})
r1 = socket$inet6_tcp(0xa, 0x1, 0x0)
r2 = dup(r1)
ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x9af139be227d9862}})
ioctl$TIOCMIWAIT(r2, 0x545c, 0x0)
r3 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000000)=ANY=[@ANYBLOB="500100001a00330600000000fddbdf25fe8000000000000000000000000000aafe8000000000000000000000000000aa000040002c6c80050000800000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="fe8000000000000000000000000000bb000000003200000000000000000000000000000000000001230300000000000001000080000000000000000000000000c0000000000000000040000000000000000000000000000000000000000000000800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000029bd7000033500000a000500000000000000000048000200656362286369706865725f6e756c6c290000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000005002100020000000800280000000000080027"], 0x150}, 0x1, 0x0, 0x0, 0x4000}, 0x200080d4)
r4 = openat(0xffffffffffffffff, &(0x7f00000000c0)='./file1\x00', 0x281c2, 0x0)
r5 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$inet6_int(r5, 0x29, 0x35, &(0x7f0000000000)=0x7907, 0x4)
bind$inet6(r5, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x7ff, @empty, 0x9}, 0x1c)
recvmmsg(r5, &(0x7f0000000240)=[{{0x0, 0x0, 0x0}, 0x8}], 0x1, 0x2, 0x0)
sendto$inet6(r2, 0x0, 0x0, 0x20004184, &(0x7f0000000200)={0xa, 0x4e20, 0x0, @local}, 0x1c)
r6 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$inet_tcp_int(r6, 0x6, 0x210000000013, &(0x7f0000000040)=0x100000001, 0x4)
setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r4, 0x6, 0x14, &(0x7f0000000140)=0x2, 0x4)
getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r6, 0x6, 0x15, 0x0, &(0x7f0000001880))
fcntl$setlease(r4, 0x400, 0x1)
fcntl$getflags(r4, 0x401)
ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_CLIENT(r4, 0xc04c5349, &(0x7f0000000040)={0x1, 0xfc, 0x8})
socket$inet6_tcp(0xa, 0x1, 0x0)
r7 = syz_open_dev$ttys(0xc, 0x2, 0x0)
ioctl$GIO_CMAP(r7, 0x4b70, &(0x7f0000000000))

program crashed: possible deadlock in rfcomm_security_cfm
testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [1, 26]
detailed listing:
executing program 1:
syz_emit_vhci(&(0x7f0000001a40)=@HCI_EVENT_PKT={0x4, @hci_ev_auth_complete={{0x6, 0x3}, {0x0, 0xc9}}}, 0x6)
executing program 0:
getrandom(&(0x7f0000000240)=""/286, 0xffffff9a, 0x0)
r0 = syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3)
connect$bt_rfcomm(r0, &(0x7f00000003c0)={0x1f, @none, 0x8}, 0xa)
getsockopt$sock_buf(r0, 0x1, 0x1c, 0x0, &(0x7f0000004c00))
capget(&(0x7f00000000c0)={0x19980330}, &(0x7f0000000100)={0x4, 0xfffffff7, 0x4, 0x8, 0x6, 0xffff})
r1 = socket$inet6_tcp(0xa, 0x1, 0x0)
r2 = dup(r1)
ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x9af139be227d9862}})
ioctl$TIOCMIWAIT(r2, 0x545c, 0x0)
r3 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000000)=ANY=[@ANYBLOB="500100001a00330600000000fddbdf25fe8000000000000000000000000000aafe8000000000000000000000000000aa000040002c6c80050000800000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="fe8000000000000000000000000000bb000000003200000000000000000000000000000000000001230300000000000001000080000000000000000000000000c0000000000000000040000000000000000000000000000000000000000000000800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000029bd7000033500000a000500000000000000000048000200656362286369706865725f6e756c6c290000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000005002100020000000800280000000000080027"], 0x150}, 0x1, 0x0, 0x0, 0x4000}, 0x200080d4)
r4 = openat(0xffffffffffffffff, &(0x7f00000000c0)='./file1\x00', 0x281c2, 0x0)
r5 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$inet6_int(r5, 0x29, 0x35, &(0x7f0000000000)=0x7907, 0x4)
bind$inet6(r5, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x7ff, @empty, 0x9}, 0x1c)
recvmmsg(r5, &(0x7f0000000240)=[{{0x0, 0x0, 0x0}, 0x8}], 0x1, 0x2, 0x0)
sendto$inet6(r2, 0x0, 0x0, 0x20004184, &(0x7f0000000200)={0xa, 0x4e20, 0x0, @local}, 0x1c)
r6 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$inet_tcp_int(r6, 0x6, 0x210000000013, &(0x7f0000000040)=0x100000001, 0x4)
setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r4, 0x6, 0x14, &(0x7f0000000140)=0x2, 0x4)
getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r6, 0x6, 0x15, 0x0, &(0x7f0000001880))
fcntl$setlease(r4, 0x400, 0x1)
fcntl$getflags(r4, 0x401)
ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_CLIENT(r4, 0xc04c5349, &(0x7f0000000040)={0x1, 0xfc, 0x8})
socket$inet6_tcp(0xa, 0x1, 0x0)
syz_open_dev$ttys(0xc, 0x2, 0x0)

program crashed: possible deadlock in l2cap_chan_connect
testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [1, 25]
detailed listing:
executing program 1:
syz_emit_vhci(&(0x7f0000001a40)=@HCI_EVENT_PKT={0x4, @hci_ev_auth_complete={{0x6, 0x3}, {0x0, 0xc9}}}, 0x6)
executing program 0:
getrandom(&(0x7f0000000240)=""/286, 0xffffff9a, 0x0)
r0 = syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3)
connect$bt_rfcomm(r0, &(0x7f00000003c0)={0x1f, @none, 0x8}, 0xa)
getsockopt$sock_buf(r0, 0x1, 0x1c, 0x0, &(0x7f0000004c00))
capget(&(0x7f00000000c0)={0x19980330}, &(0x7f0000000100)={0x4, 0xfffffff7, 0x4, 0x8, 0x6, 0xffff})
r1 = socket$inet6_tcp(0xa, 0x1, 0x0)
r2 = dup(r1)
ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x9af139be227d9862}})
ioctl$TIOCMIWAIT(r2, 0x545c, 0x0)
r3 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000000)=ANY=[@ANYBLOB="500100001a00330600000000fddbdf25fe8000000000000000000000000000aafe8000000000000000000000000000aa000040002c6c80050000800000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="fe8000000000000000000000000000bb000000003200000000000000000000000000000000000001230300000000000001000080000000000000000000000000c0000000000000000040000000000000000000000000000000000000000000000800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000029bd7000033500000a000500000000000000000048000200656362286369706865725f6e756c6c290000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000005002100020000000800280000000000080027"], 0x150}, 0x1, 0x0, 0x0, 0x4000}, 0x200080d4)
r4 = openat(0xffffffffffffffff, &(0x7f00000000c0)='./file1\x00', 0x281c2, 0x0)
r5 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$inet6_int(r5, 0x29, 0x35, &(0x7f0000000000)=0x7907, 0x4)
bind$inet6(r5, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x7ff, @empty, 0x9}, 0x1c)
recvmmsg(r5, &(0x7f0000000240)=[{{0x0, 0x0, 0x0}, 0x8}], 0x1, 0x2, 0x0)
sendto$inet6(r2, 0x0, 0x0, 0x20004184, &(0x7f0000000200)={0xa, 0x4e20, 0x0, @local}, 0x1c)
r6 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$inet_tcp_int(r6, 0x6, 0x210000000013, &(0x7f0000000040)=0x100000001, 0x4)
setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r4, 0x6, 0x14, &(0x7f0000000140)=0x2, 0x4)
getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r6, 0x6, 0x15, 0x0, &(0x7f0000001880))
fcntl$setlease(r4, 0x400, 0x1)
fcntl$getflags(r4, 0x401)
ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_CLIENT(r4, 0xc04c5349, &(0x7f0000000040)={0x1, 0xfc, 0x8})
socket$inet6_tcp(0xa, 0x1, 0x0)

program crashed: possible deadlock in rfcomm_security_cfm
testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [1, 24]
detailed listing:
executing program 1:
syz_emit_vhci(&(0x7f0000001a40)=@HCI_EVENT_PKT={0x4, @hci_ev_auth_complete={{0x6, 0x3}, {0x0, 0xc9}}}, 0x6)
executing program 0:
getrandom(&(0x7f0000000240)=""/286, 0xffffff9a, 0x0)
r0 = syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3)
connect$bt_rfcomm(r0, &(0x7f00000003c0)={0x1f, @none, 0x8}, 0xa)
getsockopt$sock_buf(r0, 0x1, 0x1c, 0x0, &(0x7f0000004c00))
capget(&(0x7f00000000c0)={0x19980330}, &(0x7f0000000100)={0x4, 0xfffffff7, 0x4, 0x8, 0x6, 0xffff})
r1 = socket$inet6_tcp(0xa, 0x1, 0x0)
r2 = dup(r1)
ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x9af139be227d9862}})
ioctl$TIOCMIWAIT(r2, 0x545c, 0x0)
r3 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000000)=ANY=[@ANYBLOB="500100001a00330600000000fddbdf25fe8000000000000000000000000000aafe8000000000000000000000000000aa000040002c6c80050000800000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="fe8000000000000000000000000000bb000000003200000000000000000000000000000000000001230300000000000001000080000000000000000000000000c0000000000000000040000000000000000000000000000000000000000000000800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000029bd7000033500000a000500000000000000000048000200656362286369706865725f6e756c6c290000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000005002100020000000800280000000000080027"], 0x150}, 0x1, 0x0, 0x0, 0x4000}, 0x200080d4)
r4 = openat(0xffffffffffffffff, &(0x7f00000000c0)='./file1\x00', 0x281c2, 0x0)
r5 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$inet6_int(r5, 0x29, 0x35, &(0x7f0000000000)=0x7907, 0x4)
bind$inet6(r5, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x7ff, @empty, 0x9}, 0x1c)
recvmmsg(r5, &(0x7f0000000240)=[{{0x0, 0x0, 0x0}, 0x8}], 0x1, 0x2, 0x0)
sendto$inet6(r2, 0x0, 0x0, 0x20004184, &(0x7f0000000200)={0xa, 0x4e20, 0x0, @local}, 0x1c)
r6 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$inet_tcp_int(r6, 0x6, 0x210000000013, &(0x7f0000000040)=0x100000001, 0x4)
setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r4, 0x6, 0x14, &(0x7f0000000140)=0x2, 0x4)
getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r6, 0x6, 0x15, 0x0, &(0x7f0000001880))
fcntl$setlease(r4, 0x400, 0x1)
fcntl$getflags(r4, 0x401)
ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_CLIENT(r4, 0xc04c5349, &(0x7f0000000040)={0x1, 0xfc, 0x8})

program crashed: possible deadlock in rfcomm_security_cfm
testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [1, 23]
detailed listing:
executing program 1:
syz_emit_vhci(&(0x7f0000001a40)=@HCI_EVENT_PKT={0x4, @hci_ev_auth_complete={{0x6, 0x3}, {0x0, 0xc9}}}, 0x6)
executing program 0:
getrandom(&(0x7f0000000240)=""/286, 0xffffff9a, 0x0)
r0 = syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3)
connect$bt_rfcomm(r0, &(0x7f00000003c0)={0x1f, @none, 0x8}, 0xa)
getsockopt$sock_buf(r0, 0x1, 0x1c, 0x0, &(0x7f0000004c00))
capget(&(0x7f00000000c0)={0x19980330}, &(0x7f0000000100)={0x4, 0xfffffff7, 0x4, 0x8, 0x6, 0xffff})
r1 = socket$inet6_tcp(0xa, 0x1, 0x0)
r2 = dup(r1)
ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x9af139be227d9862}})
ioctl$TIOCMIWAIT(r2, 0x545c, 0x0)
r3 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000000)=ANY=[@ANYBLOB="500100001a00330600000000fddbdf25fe8000000000000000000000000000aafe8000000000000000000000000000aa000040002c6c80050000800000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="fe8000000000000000000000000000bb000000003200000000000000000000000000000000000001230300000000000001000080000000000000000000000000c0000000000000000040000000000000000000000000000000000000000000000800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000029bd7000033500000a000500000000000000000048000200656362286369706865725f6e756c6c290000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000005002100020000000800280000000000080027"], 0x150}, 0x1, 0x0, 0x0, 0x4000}, 0x200080d4)
r4 = openat(0xffffffffffffffff, &(0x7f00000000c0)='./file1\x00', 0x281c2, 0x0)
r5 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$inet6_int(r5, 0x29, 0x35, &(0x7f0000000000)=0x7907, 0x4)
bind$inet6(r5, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x7ff, @empty, 0x9}, 0x1c)
recvmmsg(r5, &(0x7f0000000240)=[{{0x0, 0x0, 0x0}, 0x8}], 0x1, 0x2, 0x0)
sendto$inet6(r2, 0x0, 0x0, 0x20004184, &(0x7f0000000200)={0xa, 0x4e20, 0x0, @local}, 0x1c)
r6 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$inet_tcp_int(r6, 0x6, 0x210000000013, &(0x7f0000000040)=0x100000001, 0x4)
setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r4, 0x6, 0x14, &(0x7f0000000140)=0x2, 0x4)
getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r6, 0x6, 0x15, 0x0, &(0x7f0000001880))
fcntl$setlease(r4, 0x400, 0x1)
fcntl$getflags(r4, 0x401)

program crashed: possible deadlock in l2cap_chan_connect
testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [1, 22]
detailed listing:
executing program 1:
syz_emit_vhci(&(0x7f0000001a40)=@HCI_EVENT_PKT={0x4, @hci_ev_auth_complete={{0x6, 0x3}, {0x0, 0xc9}}}, 0x6)
executing program 0:
getrandom(&(0x7f0000000240)=""/286, 0xffffff9a, 0x0)
r0 = syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3)
connect$bt_rfcomm(r0, &(0x7f00000003c0)={0x1f, @none, 0x8}, 0xa)
getsockopt$sock_buf(r0, 0x1, 0x1c, 0x0, &(0x7f0000004c00))
capget(&(0x7f00000000c0)={0x19980330}, &(0x7f0000000100)={0x4, 0xfffffff7, 0x4, 0x8, 0x6, 0xffff})
r1 = socket$inet6_tcp(0xa, 0x1, 0x0)
r2 = dup(r1)
ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x9af139be227d9862}})
ioctl$TIOCMIWAIT(r2, 0x545c, 0x0)
r3 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000000)=ANY=[@ANYBLOB="500100001a00330600000000fddbdf25fe8000000000000000000000000000aafe8000000000000000000000000000aa000040002c6c80050000800000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="fe8000000000000000000000000000bb000000003200000000000000000000000000000000000001230300000000000001000080000000000000000000000000c0000000000000000040000000000000000000000000000000000000000000000800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000029bd7000033500000a000500000000000000000048000200656362286369706865725f6e756c6c290000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000005002100020000000800280000000000080027"], 0x150}, 0x1, 0x0, 0x0, 0x4000}, 0x200080d4)
r4 = openat(0xffffffffffffffff, &(0x7f00000000c0)='./file1\x00', 0x281c2, 0x0)
r5 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$inet6_int(r5, 0x29, 0x35, &(0x7f0000000000)=0x7907, 0x4)
bind$inet6(r5, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x7ff, @empty, 0x9}, 0x1c)
recvmmsg(r5, &(0x7f0000000240)=[{{0x0, 0x0, 0x0}, 0x8}], 0x1, 0x2, 0x0)
sendto$inet6(r2, 0x0, 0x0, 0x20004184, &(0x7f0000000200)={0xa, 0x4e20, 0x0, @local}, 0x1c)
r6 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$inet_tcp_int(r6, 0x6, 0x210000000013, &(0x7f0000000040)=0x100000001, 0x4)
setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r4, 0x6, 0x14, &(0x7f0000000140)=0x2, 0x4)
getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r6, 0x6, 0x15, 0x0, &(0x7f0000001880))
fcntl$setlease(r4, 0x400, 0x1)

program crashed: possible deadlock in l2cap_chan_connect
testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [1, 21]
detailed listing:
executing program 1:
syz_emit_vhci(&(0x7f0000001a40)=@HCI_EVENT_PKT={0x4, @hci_ev_auth_complete={{0x6, 0x3}, {0x0, 0xc9}}}, 0x6)
executing program 0:
getrandom(&(0x7f0000000240)=""/286, 0xffffff9a, 0x0)
r0 = syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3)
connect$bt_rfcomm(r0, &(0x7f00000003c0)={0x1f, @none, 0x8}, 0xa)
getsockopt$sock_buf(r0, 0x1, 0x1c, 0x0, &(0x7f0000004c00))
capget(&(0x7f00000000c0)={0x19980330}, &(0x7f0000000100)={0x4, 0xfffffff7, 0x4, 0x8, 0x6, 0xffff})
r1 = socket$inet6_tcp(0xa, 0x1, 0x0)
r2 = dup(r1)
ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x9af139be227d9862}})
ioctl$TIOCMIWAIT(r2, 0x545c, 0x0)
r3 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000000)=ANY=[@ANYBLOB="500100001a00330600000000fddbdf25fe8000000000000000000000000000aafe8000000000000000000000000000aa000040002c6c80050000800000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="fe8000000000000000000000000000bb000000003200000000000000000000000000000000000001230300000000000001000080000000000000000000000000c0000000000000000040000000000000000000000000000000000000000000000800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000029bd7000033500000a000500000000000000000048000200656362286369706865725f6e756c6c290000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000005002100020000000800280000000000080027"], 0x150}, 0x1, 0x0, 0x0, 0x4000}, 0x200080d4)
r4 = openat(0xffffffffffffffff, &(0x7f00000000c0)='./file1\x00', 0x281c2, 0x0)
r5 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$inet6_int(r5, 0x29, 0x35, &(0x7f0000000000)=0x7907, 0x4)
bind$inet6(r5, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x7ff, @empty, 0x9}, 0x1c)
recvmmsg(r5, &(0x7f0000000240)=[{{0x0, 0x0, 0x0}, 0x8}], 0x1, 0x2, 0x0)
sendto$inet6(r2, 0x0, 0x0, 0x20004184, &(0x7f0000000200)={0xa, 0x4e20, 0x0, @local}, 0x1c)
r6 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$inet_tcp_int(r6, 0x6, 0x210000000013, &(0x7f0000000040)=0x100000001, 0x4)
setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r4, 0x6, 0x14, &(0x7f0000000140)=0x2, 0x4)
getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r6, 0x6, 0x15, 0x0, &(0x7f0000001880))

program crashed: possible deadlock in rfcomm_security_cfm
testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [1, 20]
detailed listing:
executing program 1:
syz_emit_vhci(&(0x7f0000001a40)=@HCI_EVENT_PKT={0x4, @hci_ev_auth_complete={{0x6, 0x3}, {0x0, 0xc9}}}, 0x6)
executing program 0:
getrandom(&(0x7f0000000240)=""/286, 0xffffff9a, 0x0)
r0 = syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3)
connect$bt_rfcomm(r0, &(0x7f00000003c0)={0x1f, @none, 0x8}, 0xa)
getsockopt$sock_buf(r0, 0x1, 0x1c, 0x0, &(0x7f0000004c00))
capget(&(0x7f00000000c0)={0x19980330}, &(0x7f0000000100)={0x4, 0xfffffff7, 0x4, 0x8, 0x6, 0xffff})
r1 = socket$inet6_tcp(0xa, 0x1, 0x0)
r2 = dup(r1)
ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x9af139be227d9862}})
ioctl$TIOCMIWAIT(r2, 0x545c, 0x0)
r3 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000000)=ANY=[@ANYBLOB="500100001a00330600000000fddbdf25fe8000000000000000000000000000aafe8000000000000000000000000000aa000040002c6c80050000800000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="fe8000000000000000000000000000bb000000003200000000000000000000000000000000000001230300000000000001000080000000000000000000000000c0000000000000000040000000000000000000000000000000000000000000000800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000029bd7000033500000a000500000000000000000048000200656362286369706865725f6e756c6c290000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000005002100020000000800280000000000080027"], 0x150}, 0x1, 0x0, 0x0, 0x4000}, 0x200080d4)
r4 = openat(0xffffffffffffffff, &(0x7f00000000c0)='./file1\x00', 0x281c2, 0x0)
r5 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$inet6_int(r5, 0x29, 0x35, &(0x7f0000000000)=0x7907, 0x4)
bind$inet6(r5, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x7ff, @empty, 0x9}, 0x1c)
recvmmsg(r5, &(0x7f0000000240)=[{{0x0, 0x0, 0x0}, 0x8}], 0x1, 0x2, 0x0)
sendto$inet6(r2, 0x0, 0x0, 0x20004184, &(0x7f0000000200)={0xa, 0x4e20, 0x0, @local}, 0x1c)
r6 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$inet_tcp_int(r6, 0x6, 0x210000000013, &(0x7f0000000040)=0x100000001, 0x4)
setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r4, 0x6, 0x14, &(0x7f0000000140)=0x2, 0x4)

program crashed: possible deadlock in rfcomm_security_cfm
testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [1, 19]
detailed listing:
executing program 1:
syz_emit_vhci(&(0x7f0000001a40)=@HCI_EVENT_PKT={0x4, @hci_ev_auth_complete={{0x6, 0x3}, {0x0, 0xc9}}}, 0x6)
executing program 0:
getrandom(&(0x7f0000000240)=""/286, 0xffffff9a, 0x0)
r0 = syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3)
connect$bt_rfcomm(r0, &(0x7f00000003c0)={0x1f, @none, 0x8}, 0xa)
getsockopt$sock_buf(r0, 0x1, 0x1c, 0x0, &(0x7f0000004c00))
capget(&(0x7f00000000c0)={0x19980330}, &(0x7f0000000100)={0x4, 0xfffffff7, 0x4, 0x8, 0x6, 0xffff})
r1 = socket$inet6_tcp(0xa, 0x1, 0x0)
r2 = dup(r1)
ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x9af139be227d9862}})
ioctl$TIOCMIWAIT(r2, 0x545c, 0x0)
r3 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000000)=ANY=[@ANYBLOB="500100001a00330600000000fddbdf25fe8000000000000000000000000000aafe8000000000000000000000000000aa000040002c6c80050000800000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="fe8000000000000000000000000000bb000000003200000000000000000000000000000000000001230300000000000001000080000000000000000000000000c0000000000000000040000000000000000000000000000000000000000000000800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000029bd7000033500000a000500000000000000000048000200656362286369706865725f6e756c6c290000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000005002100020000000800280000000000080027"], 0x150}, 0x1, 0x0, 0x0, 0x4000}, 0x200080d4)
openat(0xffffffffffffffff, &(0x7f00000000c0)='./file1\x00', 0x281c2, 0x0)
r4 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$inet6_int(r4, 0x29, 0x35, &(0x7f0000000000)=0x7907, 0x4)
bind$inet6(r4, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x7ff, @empty, 0x9}, 0x1c)
recvmmsg(r4, &(0x7f0000000240)=[{{0x0, 0x0, 0x0}, 0x8}], 0x1, 0x2, 0x0)
sendto$inet6(r2, 0x0, 0x0, 0x20004184, &(0x7f0000000200)={0xa, 0x4e20, 0x0, @local}, 0x1c)
r5 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$inet_tcp_int(r5, 0x6, 0x210000000013, &(0x7f0000000040)=0x100000001, 0x4)

program crashed: possible deadlock in l2cap_chan_connect
testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [1, 18]
detailed listing:
executing program 1:
syz_emit_vhci(&(0x7f0000001a40)=@HCI_EVENT_PKT={0x4, @hci_ev_auth_complete={{0x6, 0x3}, {0x0, 0xc9}}}, 0x6)
executing program 0:
getrandom(&(0x7f0000000240)=""/286, 0xffffff9a, 0x0)
r0 = syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3)
connect$bt_rfcomm(r0, &(0x7f00000003c0)={0x1f, @none, 0x8}, 0xa)
getsockopt$sock_buf(r0, 0x1, 0x1c, 0x0, &(0x7f0000004c00))
capget(&(0x7f00000000c0)={0x19980330}, &(0x7f0000000100)={0x4, 0xfffffff7, 0x4, 0x8, 0x6, 0xffff})
r1 = socket$inet6_tcp(0xa, 0x1, 0x0)
r2 = dup(r1)
ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x9af139be227d9862}})
ioctl$TIOCMIWAIT(r2, 0x545c, 0x0)
r3 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000000)=ANY=[@ANYBLOB="500100001a00330600000000fddbdf25fe8000000000000000000000000000aafe8000000000000000000000000000aa000040002c6c80050000800000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="fe8000000000000000000000000000bb000000003200000000000000000000000000000000000001230300000000000001000080000000000000000000000000c0000000000000000040000000000000000000000000000000000000000000000800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000029bd7000033500000a000500000000000000000048000200656362286369706865725f6e756c6c290000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000005002100020000000800280000000000080027"], 0x150}, 0x1, 0x0, 0x0, 0x4000}, 0x200080d4)
openat(0xffffffffffffffff, &(0x7f00000000c0)='./file1\x00', 0x281c2, 0x0)
r4 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$inet6_int(r4, 0x29, 0x35, &(0x7f0000000000)=0x7907, 0x4)
bind$inet6(r4, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x7ff, @empty, 0x9}, 0x1c)
recvmmsg(r4, &(0x7f0000000240)=[{{0x0, 0x0, 0x0}, 0x8}], 0x1, 0x2, 0x0)
sendto$inet6(r2, 0x0, 0x0, 0x20004184, &(0x7f0000000200)={0xa, 0x4e20, 0x0, @local}, 0x1c)
socket$inet_tcp(0x2, 0x1, 0x0)

program crashed: possible deadlock in l2cap_chan_connect
testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [1, 17]
detailed listing:
executing program 1:
syz_emit_vhci(&(0x7f0000001a40)=@HCI_EVENT_PKT={0x4, @hci_ev_auth_complete={{0x6, 0x3}, {0x0, 0xc9}}}, 0x6)
executing program 0:
getrandom(&(0x7f0000000240)=""/286, 0xffffff9a, 0x0)
r0 = syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3)
connect$bt_rfcomm(r0, &(0x7f00000003c0)={0x1f, @none, 0x8}, 0xa)
getsockopt$sock_buf(r0, 0x1, 0x1c, 0x0, &(0x7f0000004c00))
capget(&(0x7f00000000c0)={0x19980330}, &(0x7f0000000100)={0x4, 0xfffffff7, 0x4, 0x8, 0x6, 0xffff})
r1 = socket$inet6_tcp(0xa, 0x1, 0x0)
r2 = dup(r1)
ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x9af139be227d9862}})
ioctl$TIOCMIWAIT(r2, 0x545c, 0x0)
r3 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000000)=ANY=[@ANYBLOB="500100001a00330600000000fddbdf25fe8000000000000000000000000000aafe8000000000000000000000000000aa000040002c6c80050000800000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="fe8000000000000000000000000000bb000000003200000000000000000000000000000000000001230300000000000001000080000000000000000000000000c0000000000000000040000000000000000000000000000000000000000000000800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000029bd7000033500000a000500000000000000000048000200656362286369706865725f6e756c6c290000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000005002100020000000800280000000000080027"], 0x150}, 0x1, 0x0, 0x0, 0x4000}, 0x200080d4)
openat(0xffffffffffffffff, &(0x7f00000000c0)='./file1\x00', 0x281c2, 0x0)
r4 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$inet6_int(r4, 0x29, 0x35, &(0x7f0000000000)=0x7907, 0x4)
bind$inet6(r4, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x7ff, @empty, 0x9}, 0x1c)
recvmmsg(r4, &(0x7f0000000240)=[{{0x0, 0x0, 0x0}, 0x8}], 0x1, 0x2, 0x0)
sendto$inet6(r2, 0x0, 0x0, 0x20004184, &(0x7f0000000200)={0xa, 0x4e20, 0x0, @local}, 0x1c)

program crashed: possible deadlock in l2cap_chan_connect
testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [1, 16]
detailed listing:
executing program 1:
syz_emit_vhci(&(0x7f0000001a40)=@HCI_EVENT_PKT={0x4, @hci_ev_auth_complete={{0x6, 0x3}, {0x0, 0xc9}}}, 0x6)
executing program 0:
getrandom(&(0x7f0000000240)=""/286, 0xffffff9a, 0x0)
r0 = syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3)
connect$bt_rfcomm(r0, &(0x7f00000003c0)={0x1f, @none, 0x8}, 0xa)
getsockopt$sock_buf(r0, 0x1, 0x1c, 0x0, &(0x7f0000004c00))
capget(&(0x7f00000000c0)={0x19980330}, &(0x7f0000000100)={0x4, 0xfffffff7, 0x4, 0x8, 0x6, 0xffff})
r1 = socket$inet6_tcp(0xa, 0x1, 0x0)
r2 = dup(r1)
ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x9af139be227d9862}})
ioctl$TIOCMIWAIT(r2, 0x545c, 0x0)
r3 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000000)=ANY=[@ANYBLOB="500100001a00330600000000fddbdf25fe8000000000000000000000000000aafe8000000000000000000000000000aa000040002c6c80050000800000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="fe8000000000000000000000000000bb000000003200000000000000000000000000000000000001230300000000000001000080000000000000000000000000c0000000000000000040000000000000000000000000000000000000000000000800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000029bd7000033500000a000500000000000000000048000200656362286369706865725f6e756c6c290000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000005002100020000000800280000000000080027"], 0x150}, 0x1, 0x0, 0x0, 0x4000}, 0x200080d4)
openat(0xffffffffffffffff, &(0x7f00000000c0)='./file1\x00', 0x281c2, 0x0)
r4 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$inet6_int(r4, 0x29, 0x35, &(0x7f0000000000)=0x7907, 0x4)
bind$inet6(r4, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x7ff, @empty, 0x9}, 0x1c)
recvmmsg(r4, &(0x7f0000000240)=[{{0x0, 0x0, 0x0}, 0x8}], 0x1, 0x2, 0x0)

program crashed: possible deadlock in l2cap_chan_connect
testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [1, 15]
detailed listing:
executing program 1:
syz_emit_vhci(&(0x7f0000001a40)=@HCI_EVENT_PKT={0x4, @hci_ev_auth_complete={{0x6, 0x3}, {0x0, 0xc9}}}, 0x6)
executing program 0:
getrandom(&(0x7f0000000240)=""/286, 0xffffff9a, 0x0)
r0 = syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3)
connect$bt_rfcomm(r0, &(0x7f00000003c0)={0x1f, @none, 0x8}, 0xa)
getsockopt$sock_buf(r0, 0x1, 0x1c, 0x0, &(0x7f0000004c00))
capget(&(0x7f00000000c0)={0x19980330}, &(0x7f0000000100)={0x4, 0xfffffff7, 0x4, 0x8, 0x6, 0xffff})
r1 = socket$inet6_tcp(0xa, 0x1, 0x0)
r2 = dup(r1)
ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x9af139be227d9862}})
ioctl$TIOCMIWAIT(r2, 0x545c, 0x0)
r3 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000000)=ANY=[@ANYBLOB="500100001a00330600000000fddbdf25fe8000000000000000000000000000aafe8000000000000000000000000000aa000040002c6c80050000800000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="fe8000000000000000000000000000bb000000003200000000000000000000000000000000000001230300000000000001000080000000000000000000000000c0000000000000000040000000000000000000000000000000000000000000000800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000029bd7000033500000a000500000000000000000048000200656362286369706865725f6e756c6c290000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000005002100020000000800280000000000080027"], 0x150}, 0x1, 0x0, 0x0, 0x4000}, 0x200080d4)
openat(0xffffffffffffffff, &(0x7f00000000c0)='./file1\x00', 0x281c2, 0x0)
r4 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$inet6_int(r4, 0x29, 0x35, &(0x7f0000000000)=0x7907, 0x4)
bind$inet6(r4, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x7ff, @empty, 0x9}, 0x1c)

program crashed: possible deadlock in rfcomm_security_cfm
testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [1, 14]
detailed listing:
executing program 1:
syz_emit_vhci(&(0x7f0000001a40)=@HCI_EVENT_PKT={0x4, @hci_ev_auth_complete={{0x6, 0x3}, {0x0, 0xc9}}}, 0x6)
executing program 0:
getrandom(&(0x7f0000000240)=""/286, 0xffffff9a, 0x0)
r0 = syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3)
connect$bt_rfcomm(r0, &(0x7f00000003c0)={0x1f, @none, 0x8}, 0xa)
getsockopt$sock_buf(r0, 0x1, 0x1c, 0x0, &(0x7f0000004c00))
capget(&(0x7f00000000c0)={0x19980330}, &(0x7f0000000100)={0x4, 0xfffffff7, 0x4, 0x8, 0x6, 0xffff})
r1 = socket$inet6_tcp(0xa, 0x1, 0x0)
r2 = dup(r1)
ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x9af139be227d9862}})
ioctl$TIOCMIWAIT(r2, 0x545c, 0x0)
r3 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000000)=ANY=[@ANYBLOB="500100001a00330600000000fddbdf25fe8000000000000000000000000000aafe8000000000000000000000000000aa000040002c6c80050000800000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="fe8000000000000000000000000000bb000000003200000000000000000000000000000000000001230300000000000001000080000000000000000000000000c0000000000000000040000000000000000000000000000000000000000000000800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000029bd7000033500000a000500000000000000000048000200656362286369706865725f6e756c6c290000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000005002100020000000800280000000000080027"], 0x150}, 0x1, 0x0, 0x0, 0x4000}, 0x200080d4)
openat(0xffffffffffffffff, &(0x7f00000000c0)='./file1\x00', 0x281c2, 0x0)
r4 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$inet6_int(r4, 0x29, 0x35, &(0x7f0000000000)=0x7907, 0x4)

program crashed: possible deadlock in rfcomm_security_cfm
testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [1, 13]
detailed listing:
executing program 1:
syz_emit_vhci(&(0x7f0000001a40)=@HCI_EVENT_PKT={0x4, @hci_ev_auth_complete={{0x6, 0x3}, {0x0, 0xc9}}}, 0x6)
executing program 0:
getrandom(&(0x7f0000000240)=""/286, 0xffffff9a, 0x0)
r0 = syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3)
connect$bt_rfcomm(r0, &(0x7f00000003c0)={0x1f, @none, 0x8}, 0xa)
getsockopt$sock_buf(r0, 0x1, 0x1c, 0x0, &(0x7f0000004c00))
capget(&(0x7f00000000c0)={0x19980330}, &(0x7f0000000100)={0x4, 0xfffffff7, 0x4, 0x8, 0x6, 0xffff})
r1 = socket$inet6_tcp(0xa, 0x1, 0x0)
r2 = dup(r1)
ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x9af139be227d9862}})
ioctl$TIOCMIWAIT(r2, 0x545c, 0x0)
r3 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000000)=ANY=[@ANYBLOB="500100001a00330600000000fddbdf25fe8000000000000000000000000000aafe8000000000000000000000000000aa000040002c6c80050000800000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="fe8000000000000000000000000000bb000000003200000000000000000000000000000000000001230300000000000001000080000000000000000000000000c0000000000000000040000000000000000000000000000000000000000000000800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000029bd7000033500000a000500000000000000000048000200656362286369706865725f6e756c6c290000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000005002100020000000800280000000000080027"], 0x150}, 0x1, 0x0, 0x0, 0x4000}, 0x200080d4)
openat(0xffffffffffffffff, &(0x7f00000000c0)='./file1\x00', 0x281c2, 0x0)
socket$inet6(0xa, 0x2, 0x0)

program crashed: possible deadlock in l2cap_chan_connect
testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [1, 12]
detailed listing:
executing program 1:
syz_emit_vhci(&(0x7f0000001a40)=@HCI_EVENT_PKT={0x4, @hci_ev_auth_complete={{0x6, 0x3}, {0x0, 0xc9}}}, 0x6)
executing program 0:
getrandom(&(0x7f0000000240)=""/286, 0xffffff9a, 0x0)
r0 = syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3)
connect$bt_rfcomm(r0, &(0x7f00000003c0)={0x1f, @none, 0x8}, 0xa)
getsockopt$sock_buf(r0, 0x1, 0x1c, 0x0, &(0x7f0000004c00))
capget(&(0x7f00000000c0)={0x19980330}, &(0x7f0000000100)={0x4, 0xfffffff7, 0x4, 0x8, 0x6, 0xffff})
r1 = socket$inet6_tcp(0xa, 0x1, 0x0)
r2 = dup(r1)
ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x9af139be227d9862}})
ioctl$TIOCMIWAIT(r2, 0x545c, 0x0)
r3 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000000)=ANY=[@ANYBLOB="500100001a00330600000000fddbdf25fe8000000000000000000000000000aafe8000000000000000000000000000aa000040002c6c80050000800000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="fe8000000000000000000000000000bb000000003200000000000000000000000000000000000001230300000000000001000080000000000000000000000000c0000000000000000040000000000000000000000000000000000000000000000800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000029bd7000033500000a000500000000000000000048000200656362286369706865725f6e756c6c290000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000005002100020000000800280000000000080027"], 0x150}, 0x1, 0x0, 0x0, 0x4000}, 0x200080d4)
openat(0xffffffffffffffff, &(0x7f00000000c0)='./file1\x00', 0x281c2, 0x0)

program crashed: possible deadlock in l2cap_chan_connect
testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [1, 11]
detailed listing:
executing program 1:
syz_emit_vhci(&(0x7f0000001a40)=@HCI_EVENT_PKT={0x4, @hci_ev_auth_complete={{0x6, 0x3}, {0x0, 0xc9}}}, 0x6)
executing program 0:
getrandom(&(0x7f0000000240)=""/286, 0xffffff9a, 0x0)
r0 = syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3)
connect$bt_rfcomm(r0, &(0x7f00000003c0)={0x1f, @none, 0x8}, 0xa)
getsockopt$sock_buf(r0, 0x1, 0x1c, 0x0, &(0x7f0000004c00))
capget(&(0x7f00000000c0)={0x19980330}, &(0x7f0000000100)={0x4, 0xfffffff7, 0x4, 0x8, 0x6, 0xffff})
r1 = socket$inet6_tcp(0xa, 0x1, 0x0)
r2 = dup(r1)
ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x9af139be227d9862}})
ioctl$TIOCMIWAIT(r2, 0x545c, 0x0)
r3 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000000)=ANY=[@ANYBLOB="500100001a00330600000000fddbdf25fe8000000000000000000000000000aafe8000000000000000000000000000aa000040002c6c80050000800000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="fe8000000000000000000000000000bb000000003200000000000000000000000000000000000001230300000000000001000080000000000000000000000000c0000000000000000040000000000000000000000000000000000000000000000800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000029bd7000033500000a000500000000000000000048000200656362286369706865725f6e756c6c290000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000005002100020000000800280000000000080027"], 0x150}, 0x1, 0x0, 0x0, 0x4000}, 0x200080d4)

program crashed: possible deadlock in l2cap_chan_connect
testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [1, 10]
detailed listing:
executing program 1:
syz_emit_vhci(&(0x7f0000001a40)=@HCI_EVENT_PKT={0x4, @hci_ev_auth_complete={{0x6, 0x3}, {0x0, 0xc9}}}, 0x6)
executing program 0:
getrandom(&(0x7f0000000240)=""/286, 0xffffff9a, 0x0)
r0 = syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3)
connect$bt_rfcomm(r0, &(0x7f00000003c0)={0x1f, @none, 0x8}, 0xa)
getsockopt$sock_buf(r0, 0x1, 0x1c, 0x0, &(0x7f0000004c00))
capget(&(0x7f00000000c0)={0x19980330}, &(0x7f0000000100)={0x4, 0xfffffff7, 0x4, 0x8, 0x6, 0xffff})
r1 = socket$inet6_tcp(0xa, 0x1, 0x0)
r2 = dup(r1)
ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x9af139be227d9862}})
ioctl$TIOCMIWAIT(r2, 0x545c, 0x0)
socket$nl_xfrm(0x10, 0x3, 0x6)

program crashed: possible deadlock in l2cap_chan_connect
testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [1, 9]
detailed listing:
executing program 1:
syz_emit_vhci(&(0x7f0000001a40)=@HCI_EVENT_PKT={0x4, @hci_ev_auth_complete={{0x6, 0x3}, {0x0, 0xc9}}}, 0x6)
executing program 0:
getrandom(&(0x7f0000000240)=""/286, 0xffffff9a, 0x0)
r0 = syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3)
connect$bt_rfcomm(r0, &(0x7f00000003c0)={0x1f, @none, 0x8}, 0xa)
getsockopt$sock_buf(r0, 0x1, 0x1c, 0x0, &(0x7f0000004c00))
capget(&(0x7f00000000c0)={0x19980330}, &(0x7f0000000100)={0x4, 0xfffffff7, 0x4, 0x8, 0x6, 0xffff})
r1 = socket$inet6_tcp(0xa, 0x1, 0x0)
r2 = dup(r1)
ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x9af139be227d9862}})
ioctl$TIOCMIWAIT(r2, 0x545c, 0x0)

program crashed: possible deadlock in l2cap_chan_connect
testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [1, 8]
detailed listing:
executing program 1:
syz_emit_vhci(&(0x7f0000001a40)=@HCI_EVENT_PKT={0x4, @hci_ev_auth_complete={{0x6, 0x3}, {0x0, 0xc9}}}, 0x6)
executing program 0:
getrandom(&(0x7f0000000240)=""/286, 0xffffff9a, 0x0)
r0 = syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3)
connect$bt_rfcomm(r0, &(0x7f00000003c0)={0x1f, @none, 0x8}, 0xa)
getsockopt$sock_buf(r0, 0x1, 0x1c, 0x0, &(0x7f0000004c00))
capget(&(0x7f00000000c0)={0x19980330}, &(0x7f0000000100)={0x4, 0xfffffff7, 0x4, 0x8, 0x6, 0xffff})
r1 = socket$inet6_tcp(0xa, 0x1, 0x0)
r2 = dup(r1)
ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x9af139be227d9862}})

program crashed: possible deadlock in rfcomm_security_cfm
testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [1, 7]
detailed listing:
executing program 1:
syz_emit_vhci(&(0x7f0000001a40)=@HCI_EVENT_PKT={0x4, @hci_ev_auth_complete={{0x6, 0x3}, {0x0, 0xc9}}}, 0x6)
executing program 0:
getrandom(&(0x7f0000000240)=""/286, 0xffffff9a, 0x0)
r0 = syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3)
connect$bt_rfcomm(r0, &(0x7f00000003c0)={0x1f, @none, 0x8}, 0xa)
getsockopt$sock_buf(r0, 0x1, 0x1c, 0x0, &(0x7f0000004c00))
capget(&(0x7f00000000c0)={0x19980330}, &(0x7f0000000100)={0x4, 0xfffffff7, 0x4, 0x8, 0x6, 0xffff})
r1 = socket$inet6_tcp(0xa, 0x1, 0x0)
dup(r1)

program crashed: possible deadlock in l2cap_chan_connect
testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [1, 6]
detailed listing:
executing program 1:
syz_emit_vhci(&(0x7f0000001a40)=@HCI_EVENT_PKT={0x4, @hci_ev_auth_complete={{0x6, 0x3}, {0x0, 0xc9}}}, 0x6)
executing program 0:
getrandom(&(0x7f0000000240)=""/286, 0xffffff9a, 0x0)
r0 = syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3)
connect$bt_rfcomm(r0, &(0x7f00000003c0)={0x1f, @none, 0x8}, 0xa)
getsockopt$sock_buf(r0, 0x1, 0x1c, 0x0, &(0x7f0000004c00))
capget(&(0x7f00000000c0)={0x19980330}, &(0x7f0000000100)={0x4, 0xfffffff7, 0x4, 0x8, 0x6, 0xffff})
socket$inet6_tcp(0xa, 0x1, 0x0)

program crashed: possible deadlock in l2cap_chan_connect
testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [1, 5]
detailed listing:
executing program 1:
syz_emit_vhci(&(0x7f0000001a40)=@HCI_EVENT_PKT={0x4, @hci_ev_auth_complete={{0x6, 0x3}, {0x0, 0xc9}}}, 0x6)
executing program 0:
getrandom(&(0x7f0000000240)=""/286, 0xffffff9a, 0x0)
r0 = syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3)
connect$bt_rfcomm(r0, &(0x7f00000003c0)={0x1f, @none, 0x8}, 0xa)
getsockopt$sock_buf(r0, 0x1, 0x1c, 0x0, &(0x7f0000004c00))
capget(&(0x7f00000000c0)={0x19980330}, &(0x7f0000000100)={0x4, 0xfffffff7, 0x4, 0x8, 0x6, 0xffff})

program crashed: possible deadlock in rfcomm_security_cfm
testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [1, 4]
detailed listing:
executing program 1:
syz_emit_vhci(&(0x7f0000001a40)=@HCI_EVENT_PKT={0x4, @hci_ev_auth_complete={{0x6, 0x3}, {0x0, 0xc9}}}, 0x6)
executing program 0:
getrandom(&(0x7f0000000240)=""/286, 0xffffff9a, 0x0)
r0 = syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3)
connect$bt_rfcomm(r0, &(0x7f00000003c0)={0x1f, @none, 0x8}, 0xa)
getsockopt$sock_buf(r0, 0x1, 0x1c, 0x0, &(0x7f0000004c00))

program crashed: possible deadlock in l2cap_chan_connect
testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [1, 3]
detailed listing:
executing program 1:
syz_emit_vhci(&(0x7f0000001a40)=@HCI_EVENT_PKT={0x4, @hci_ev_auth_complete={{0x6, 0x3}, {0x0, 0xc9}}}, 0x6)
executing program 0:
getrandom(&(0x7f0000000240)=""/286, 0xffffff9a, 0x0)
r0 = syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3)
connect$bt_rfcomm(r0, &(0x7f00000003c0)={0x1f, @none, 0x8}, 0xa)

program crashed: possible deadlock in rfcomm_security_cfm
testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [1, 2]
detailed listing:
executing program 1:
syz_emit_vhci(&(0x7f0000001a40)=@HCI_EVENT_PKT={0x4, @hci_ev_auth_complete={{0x6, 0x3}, {0x0, 0xc9}}}, 0x6)
executing program 0:
getrandom(&(0x7f0000000240)=""/286, 0xffffff9a, 0x0)
syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3)

program did not crash
testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [1, 2]
detailed listing:
executing program 1:
syz_emit_vhci(&(0x7f0000001a40)=@HCI_EVENT_PKT={0x4, @hci_ev_auth_complete={{0x6, 0x3}, {0x0, 0xc9}}}, 0x6)
executing program 0:
getrandom(&(0x7f0000000240)=""/286, 0xffffff9a, 0x0)
connect$bt_rfcomm(0xffffffffffffffff, &(0x7f00000003c0)={0x1f, @none, 0x8}, 0xa)

program did not crash
testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [1, 2]
detailed listing:
executing program 1:
syz_emit_vhci(&(0x7f0000001a40)=@HCI_EVENT_PKT={0x4, @hci_ev_auth_complete={{0x6, 0x3}, {0x0, 0xc9}}}, 0x6)
executing program 0:
r0 = syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3)
connect$bt_rfcomm(r0, &(0x7f00000003c0)={0x1f, @none, 0x8}, 0xa)

program crashed: possible deadlock in l2cap_chan_connect
minimized 30 calls -> 2 calls
testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_emit_vhci-syz_init_net_socket$bt_rfcomm-connect$bt_rfcomm
detailed listing:
executing program 0:
syz_emit_vhci(&(0x7f0000001a40)=@HCI_EVENT_PKT={0x4, @hci_ev_auth_complete={{0x6, 0x3}, {0x0, 0xc9}}}, 0x6)
r0 = syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3)
connect$bt_rfcomm(r0, &(0x7f00000003c0)={0x1f, @none, 0x8}, 0xa)

program crashed: possible deadlock in l2cap_chan_connect
bisect: concatenation succeeded
found reproducer with 3 syscalls
minimizing guilty program
testing program (duration=1m21.3996428s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_emit_vhci-syz_init_net_socket$bt_rfcomm
detailed listing:
executing program 0:
syz_emit_vhci(&(0x7f0000001a40)=@HCI_EVENT_PKT={0x4, @hci_ev_auth_complete={{0x6, 0x3}, {0x0, 0xc9}}}, 0x6)
syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3)

program did not crash
testing program (duration=1m21.3996428s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_emit_vhci-connect$bt_rfcomm
detailed listing:
executing program 0:
syz_emit_vhci(&(0x7f0000001a40)=@HCI_EVENT_PKT={0x4, @hci_ev_auth_complete={{0x6, 0x3}, {0x0, 0xc9}}}, 0x6)
connect$bt_rfcomm(0xffffffffffffffff, &(0x7f00000003c0)={0x1f, @none, 0x8}, 0xa)

program did not crash
testing program (duration=1m21.3996428s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$bt_rfcomm-connect$bt_rfcomm
detailed listing:
executing program 0:
r0 = syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3)
connect$bt_rfcomm(r0, &(0x7f00000003c0)={0x1f, @none, 0x8}, 0xa)

program did not crash
testing program (duration=1m21.3996428s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_emit_vhci-syz_init_net_socket$bt_rfcomm-connect$bt_rfcomm
detailed listing:
executing program 0:
syz_emit_vhci(0x0, 0x0)
r0 = syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3)
connect$bt_rfcomm(r0, &(0x7f00000003c0)={0x1f, @none, 0x8}, 0xa)

program did not crash
testing program (duration=1m21.3996428s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_emit_vhci-syz_init_net_socket$bt_rfcomm-connect$bt_rfcomm
detailed listing:
executing program 0:
syz_emit_vhci(&(0x7f0000001a40)=@HCI_EVENT_PKT={0x4, @hci_ev_auth_complete={{0x6, 0x3}, {0x0, 0xc9}}}, 0x6)
r0 = syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3)
connect$bt_rfcomm(r0, 0x0, 0x0)

program did not crash
extracting C reproducer
testing compiled C program (duration=1m21.3996428s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_emit_vhci-syz_init_net_socket$bt_rfcomm-connect$bt_rfcomm
program crashed: possible deadlock in l2cap_chan_connect
simplifying C reproducer
testing compiled C program (duration=1m21.3996428s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_emit_vhci-syz_init_net_socket$bt_rfcomm-connect$bt_rfcomm
program crashed: possible deadlock in l2cap_chan_connect
testing compiled C program (duration=1m21.3996428s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_emit_vhci-syz_init_net_socket$bt_rfcomm-connect$bt_rfcomm
program crashed: possible deadlock in l2cap_chan_connect
testing compiled C program (duration=1m21.3996428s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_emit_vhci-syz_init_net_socket$bt_rfcomm-connect$bt_rfcomm
program did not crash
testing compiled C program (duration=1m21.3996428s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_emit_vhci-syz_init_net_socket$bt_rfcomm-connect$bt_rfcomm
program crashed: possible deadlock in l2cap_chan_connect
testing compiled C program (duration=1m21.3996428s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_emit_vhci-syz_init_net_socket$bt_rfcomm-connect$bt_rfcomm
program crashed: possible deadlock in l2cap_chan_connect
testing compiled C program (duration=1m21.3996428s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_emit_vhci-syz_init_net_socket$bt_rfcomm-connect$bt_rfcomm
program crashed: possible deadlock in l2cap_chan_connect
testing compiled C program (duration=1m21.3996428s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_emit_vhci-syz_init_net_socket$bt_rfcomm-connect$bt_rfcomm
program crashed: possible deadlock in l2cap_chan_connect
testing compiled C program (duration=1m21.3996428s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_emit_vhci-syz_init_net_socket$bt_rfcomm-connect$bt_rfcomm
program crashed: possible deadlock in l2cap_chan_connect
testing compiled C program (duration=1m21.3996428s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_emit_vhci-syz_init_net_socket$bt_rfcomm-connect$bt_rfcomm
program crashed: possible deadlock in l2cap_chan_connect
testing compiled C program (duration=1m21.3996428s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_emit_vhci-syz_init_net_socket$bt_rfcomm-connect$bt_rfcomm
program did not crash
testing compiled C program (duration=1m21.3996428s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:true Wifi:false IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_emit_vhci-syz_init_net_socket$bt_rfcomm-connect$bt_rfcomm
program crashed: possible deadlock in l2cap_chan_connect
testing compiled C program (duration=1m21.3996428s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:true Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_emit_vhci-syz_init_net_socket$bt_rfcomm-connect$bt_rfcomm
program crashed: possible deadlock in l2cap_chan_connect
testing compiled C program (duration=1m21.3996428s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:true Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_emit_vhci-syz_init_net_socket$bt_rfcomm-connect$bt_rfcomm
program crashed: possible deadlock in l2cap_chan_connect
testing compiled C program (duration=1m21.3996428s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:true Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_emit_vhci-syz_init_net_socket$bt_rfcomm-connect$bt_rfcomm
program crashed: possible deadlock in l2cap_chan_connect
testing compiled C program (duration=1m21.3996428s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:true Wifi:false IEEE802154:false Sysctl:false Swap:true UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_emit_vhci-syz_init_net_socket$bt_rfcomm-connect$bt_rfcomm
program crashed: possible deadlock in l2cap_chan_connect
testing compiled C program (duration=1m21.3996428s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:true Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_emit_vhci-syz_init_net_socket$bt_rfcomm-connect$bt_rfcomm
program crashed: possible deadlock in l2cap_chan_connect
testing program (duration=1m21.3996428s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:true Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_emit_vhci-syz_init_net_socket$bt_rfcomm-connect$bt_rfcomm
detailed listing:
executing program 0:
syz_emit_vhci(&(0x7f0000001a40)=@HCI_EVENT_PKT={0x4, @hci_ev_auth_complete={{0x6, 0x3}, {0x0, 0xc9}}}, 0x6)
r0 = syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3)
connect$bt_rfcomm(r0, &(0x7f00000003c0)={0x1f, @none, 0x8}, 0xa)

program crashed: possible deadlock in l2cap_chan_connect
validation run: crashed=true
testing program (duration=1m21.3996428s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:true Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_emit_vhci-syz_init_net_socket$bt_rfcomm-connect$bt_rfcomm
detailed listing:
executing program 0:
syz_emit_vhci(&(0x7f0000001a40)=@HCI_EVENT_PKT={0x4, @hci_ev_auth_complete={{0x6, 0x3}, {0x0, 0xc9}}}, 0x6)
r0 = syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3)
connect$bt_rfcomm(r0, &(0x7f00000003c0)={0x1f, @none, 0x8}, 0xa)

program crashed: possible deadlock in l2cap_chan_connect
validation run: crashed=true
testing program (duration=1m21.3996428s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:true Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_emit_vhci-syz_init_net_socket$bt_rfcomm-connect$bt_rfcomm
detailed listing:
executing program 0:
syz_emit_vhci(&(0x7f0000001a40)=@HCI_EVENT_PKT={0x4, @hci_ev_auth_complete={{0x6, 0x3}, {0x0, 0xc9}}}, 0x6)
r0 = syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3)
connect$bt_rfcomm(r0, &(0x7f00000003c0)={0x1f, @none, 0x8}, 0xa)

program crashed: possible deadlock in l2cap_chan_connect
validation run: crashed=true
reproducing took 2h30m49.65657048s
repro crashed as (corrupted=false):
======================================================
WARNING: possible circular locking dependency detected
syzkaller #0 Not tainted
------------------------------------------------------
syz.0.17/5897 is trying to acquire lock:
ffff8880799900b8 (&hdev->lock){+.+.}-{4:4}, at: l2cap_chan_connect+0xff/0xf60 net/bluetooth/l2cap_core.c:7271

but task is already holding lock:
ffffffff90611e00 (rfcomm_mutex){+.+.}-{4:4}, at: rfcomm_dlc_open+0x9c/0x1080 net/bluetooth/rfcomm/core.c:426

which lock already depends on the new lock.


the existing dependency chain (in reverse order) is:

-> #2 (rfcomm_mutex){+.+.}-{4:4}:
       __mutex_lock_common kernel/locking/mutex.c:646 [inline]
       __mutex_lock+0x19d/0x1550 kernel/locking/mutex.c:821
       rfcomm_security_cfm+0x90/0x820 net/bluetooth/rfcomm/core.c:2222
       hci_auth_cfm include/net/bluetooth/hci_core.h:2246 [inline]
       hci_auth_complete_evt+0x39f/0xc80 net/bluetooth/hci_event.c:3554
       hci_event_func net/bluetooth/hci_event.c:7887 [inline]
       hci_event_packet+0x6cd/0xf10 net/bluetooth/hci_event.c:7938
       hci_rx_work+0x3ee/0x1020 net/bluetooth/hci_core.c:4041
       process_one_work kernel/workqueue.c:3396 [inline]
       process_scheduled_works+0xc3d/0x1630 kernel/workqueue.c:3479
       worker_thread+0xa47/0xfb0 kernel/workqueue.c:3560
       kthread+0x38b/0x480 kernel/kthread.c:436
       ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
       ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245

-> #1 (hci_cb_list_lock){+.+.}-{4:4}:
       __mutex_lock_common kernel/locking/mutex.c:646 [inline]
       __mutex_lock+0x19d/0x1550 kernel/locking/mutex.c:821
       hci_connect_cfm include/net/bluetooth/hci_core.h:2207 [inline]
       hci_remote_features_evt+0x53d/0x950 net/bluetooth/hci_event.c:3786
       hci_event_func net/bluetooth/hci_event.c:7887 [inline]
       hci_event_packet+0x6cd/0xf10 net/bluetooth/hci_event.c:7938
       hci_rx_work+0x3ee/0x1020 net/bluetooth/hci_core.c:4041
       process_one_work kernel/workqueue.c:3396 [inline]
       process_scheduled_works+0xc3d/0x1630 kernel/workqueue.c:3479
       worker_thread+0xa47/0xfb0 kernel/workqueue.c:3560
       kthread+0x38b/0x480 kernel/kthread.c:436
       ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
       ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245

-> #0 (&hdev->lock){+.+.}-{4:4}:
       check_prev_add kernel/locking/lockdep.c:3181 [inline]
       check_prevs_add kernel/locking/lockdep.c:3300 [inline]
       validate_chain kernel/locking/lockdep.c:3924 [inline]
       __lock_acquire+0x15ff/0x2e50 kernel/locking/lockdep.c:5254
       lock_acquire+0x115/0x350 kernel/locking/lockdep.c:5908
       __mutex_lock_common kernel/locking/mutex.c:646 [inline]
       __mutex_lock+0x19d/0x1550 kernel/locking/mutex.c:821
       l2cap_chan_connect+0xff/0xf60 net/bluetooth/l2cap_core.c:7271
       l2cap_sock_connect+0x5e4/0x7e0 net/bluetooth/l2cap_sock.c:255
       kernel_connect+0x141/0x1c0 net/socket.c:3755
       rfcomm_session_create net/bluetooth/rfcomm/core.c:808 [inline]
       __rfcomm_dlc_open net/bluetooth/rfcomm/core.c:385 [inline]
       rfcomm_dlc_open+0x644/0x1080 net/bluetooth/rfcomm/core.c:428
       rfcomm_sock_connect+0x2ed/0x650 net/bluetooth/rfcomm/sock.c:421
       connect_socket net/socket.c:2141 [inline]
       __sys_connect_file net/socket.c:2166 [inline]
       __sys_connect+0x316/0x450 net/socket.c:2183
       __do_sys_connect net/socket.c:2189 [inline]
       __se_sys_connect net/socket.c:2186 [inline]
       __x64_sys_connect+0x7a/0x90 net/socket.c:2186
       do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
       do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84
       entry_SYSCALL_64_after_hwframe+0x77/0x7f

other info that might help us debug this:

Chain exists of:
  &hdev->lock --> hci_cb_list_lock --> rfcomm_mutex

 Possible unsafe locking scenario:

       CPU0                    CPU1
       ----                    ----
  lock(rfcomm_mutex);
                               lock(hci_cb_list_lock);
                               lock(rfcomm_mutex);
  lock(&hdev->lock);

 *** DEADLOCK ***

locks held by syz.0.17/5897: 1, last CPU#0:
 #0: ffffffff90611e00 (rfcomm_mutex){+.+.}-{4:4}, at: rfcomm_dlc_open+0x9c/0x1080 net/bluetooth/rfcomm/core.c:426

stack backtrace:
CPU: 0 UID: 0 PID: 5897 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Call Trace:
 <TASK>
 dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
 print_circular_bug+0x2e2/0x300 kernel/locking/lockdep.c:2059
 check_noncircular+0x12f/0x150 kernel/locking/lockdep.c:2191
 check_prev_add kernel/locking/lockdep.c:3181 [inline]
 check_prevs_add kernel/locking/lockdep.c:3300 [inline]
 validate_chain kernel/locking/lockdep.c:3924 [inline]
 __lock_acquire+0x15ff/0x2e50 kernel/locking/lockdep.c:5254
 lock_acquire+0x115/0x350 kernel/locking/lockdep.c:5908
 __mutex_lock_common kernel/locking/mutex.c:646 [inline]
 __mutex_lock+0x19d/0x1550 kernel/locking/mutex.c:821
 l2cap_chan_connect+0xff/0xf60 net/bluetooth/l2cap_core.c:7271
 l2cap_sock_connect+0x5e4/0x7e0 net/bluetooth/l2cap_sock.c:255
 kernel_connect+0x141/0x1c0 net/socket.c:3755
 rfcomm_session_create net/bluetooth/rfcomm/core.c:808 [inline]
 __rfcomm_dlc_open net/bluetooth/rfcomm/core.c:385 [inline]
 rfcomm_dlc_open+0x644/0x1080 net/bluetooth/rfcomm/core.c:428
 rfcomm_sock_connect+0x2ed/0x650 net/bluetooth/rfcomm/sock.c:421
 connect_socket net/socket.c:2141 [inline]
 __sys_connect_file net/socket.c:2166 [inline]
 __sys_connect+0x316/0x450 net/socket.c:2183
 __do_sys_connect net/socket.c:2189 [inline]
 __se_sys_connect net/socket.c:2186 [inline]
 __x64_sys_connect+0x7a/0x90 net/socket.c:2186
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f33f179e159
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffd1579d778 EFLAGS: 00000246 ORIG_RAX: 000000000000002a
RAX: ffffffffffffffda RBX: 00007f33f1a25fa0 RCX: 00007f33f179e159
RDX: 000000000000000a RSI: 00002000000003c0 RDI: 0000000000000004
RBP: 00007f33f1835024 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f33f1a25fac R14: 00007f33f1a25fa0 R15: 00007f33f1a25fa0
 </TASK>

final repro crashed as (corrupted=false):
======================================================
WARNING: possible circular locking dependency detected
syzkaller #0 Not tainted
------------------------------------------------------
syz.0.17/5897 is trying to acquire lock:
ffff8880799900b8 (&hdev->lock){+.+.}-{4:4}, at: l2cap_chan_connect+0xff/0xf60 net/bluetooth/l2cap_core.c:7271

but task is already holding lock:
ffffffff90611e00 (rfcomm_mutex){+.+.}-{4:4}, at: rfcomm_dlc_open+0x9c/0x1080 net/bluetooth/rfcomm/core.c:426

which lock already depends on the new lock.


the existing dependency chain (in reverse order) is:

-> #2 (rfcomm_mutex){+.+.}-{4:4}:
       __mutex_lock_common kernel/locking/mutex.c:646 [inline]
       __mutex_lock+0x19d/0x1550 kernel/locking/mutex.c:821
       rfcomm_security_cfm+0x90/0x820 net/bluetooth/rfcomm/core.c:2222
       hci_auth_cfm include/net/bluetooth/hci_core.h:2246 [inline]
       hci_auth_complete_evt+0x39f/0xc80 net/bluetooth/hci_event.c:3554
       hci_event_func net/bluetooth/hci_event.c:7887 [inline]
       hci_event_packet+0x6cd/0xf10 net/bluetooth/hci_event.c:7938
       hci_rx_work+0x3ee/0x1020 net/bluetooth/hci_core.c:4041
       process_one_work kernel/workqueue.c:3396 [inline]
       process_scheduled_works+0xc3d/0x1630 kernel/workqueue.c:3479
       worker_thread+0xa47/0xfb0 kernel/workqueue.c:3560
       kthread+0x38b/0x480 kernel/kthread.c:436
       ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
       ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245

-> #1 (hci_cb_list_lock){+.+.}-{4:4}:
       __mutex_lock_common kernel/locking/mutex.c:646 [inline]
       __mutex_lock+0x19d/0x1550 kernel/locking/mutex.c:821
       hci_connect_cfm include/net/bluetooth/hci_core.h:2207 [inline]
       hci_remote_features_evt+0x53d/0x950 net/bluetooth/hci_event.c:3786
       hci_event_func net/bluetooth/hci_event.c:7887 [inline]
       hci_event_packet+0x6cd/0xf10 net/bluetooth/hci_event.c:7938
       hci_rx_work+0x3ee/0x1020 net/bluetooth/hci_core.c:4041
       process_one_work kernel/workqueue.c:3396 [inline]
       process_scheduled_works+0xc3d/0x1630 kernel/workqueue.c:3479
       worker_thread+0xa47/0xfb0 kernel/workqueue.c:3560
       kthread+0x38b/0x480 kernel/kthread.c:436
       ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
       ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245

-> #0 (&hdev->lock){+.+.}-{4:4}:
       check_prev_add kernel/locking/lockdep.c:3181 [inline]
       check_prevs_add kernel/locking/lockdep.c:3300 [inline]
       validate_chain kernel/locking/lockdep.c:3924 [inline]
       __lock_acquire+0x15ff/0x2e50 kernel/locking/lockdep.c:5254
       lock_acquire+0x115/0x350 kernel/locking/lockdep.c:5908
       __mutex_lock_common kernel/locking/mutex.c:646 [inline]
       __mutex_lock+0x19d/0x1550 kernel/locking/mutex.c:821
       l2cap_chan_connect+0xff/0xf60 net/bluetooth/l2cap_core.c:7271
       l2cap_sock_connect+0x5e4/0x7e0 net/bluetooth/l2cap_sock.c:255
       kernel_connect+0x141/0x1c0 net/socket.c:3755
       rfcomm_session_create net/bluetooth/rfcomm/core.c:808 [inline]
       __rfcomm_dlc_open net/bluetooth/rfcomm/core.c:385 [inline]
       rfcomm_dlc_open+0x644/0x1080 net/bluetooth/rfcomm/core.c:428
       rfcomm_sock_connect+0x2ed/0x650 net/bluetooth/rfcomm/sock.c:421
       connect_socket net/socket.c:2141 [inline]
       __sys_connect_file net/socket.c:2166 [inline]
       __sys_connect+0x316/0x450 net/socket.c:2183
       __do_sys_connect net/socket.c:2189 [inline]
       __se_sys_connect net/socket.c:2186 [inline]
       __x64_sys_connect+0x7a/0x90 net/socket.c:2186
       do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
       do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84
       entry_SYSCALL_64_after_hwframe+0x77/0x7f

other info that might help us debug this:

Chain exists of:
  &hdev->lock --> hci_cb_list_lock --> rfcomm_mutex

 Possible unsafe locking scenario:

       CPU0                    CPU1
       ----                    ----
  lock(rfcomm_mutex);
                               lock(hci_cb_list_lock);
                               lock(rfcomm_mutex);
  lock(&hdev->lock);

 *** DEADLOCK ***

locks held by syz.0.17/5897: 1, last CPU#0:
 #0: ffffffff90611e00 (rfcomm_mutex){+.+.}-{4:4}, at: rfcomm_dlc_open+0x9c/0x1080 net/bluetooth/rfcomm/core.c:426

stack backtrace:
CPU: 0 UID: 0 PID: 5897 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Call Trace:
 <TASK>
 dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
 print_circular_bug+0x2e2/0x300 kernel/locking/lockdep.c:2059
 check_noncircular+0x12f/0x150 kernel/locking/lockdep.c:2191
 check_prev_add kernel/locking/lockdep.c:3181 [inline]
 check_prevs_add kernel/locking/lockdep.c:3300 [inline]
 validate_chain kernel/locking/lockdep.c:3924 [inline]
 __lock_acquire+0x15ff/0x2e50 kernel/locking/lockdep.c:5254
 lock_acquire+0x115/0x350 kernel/locking/lockdep.c:5908
 __mutex_lock_common kernel/locking/mutex.c:646 [inline]
 __mutex_lock+0x19d/0x1550 kernel/locking/mutex.c:821
 l2cap_chan_connect+0xff/0xf60 net/bluetooth/l2cap_core.c:7271
 l2cap_sock_connect+0x5e4/0x7e0 net/bluetooth/l2cap_sock.c:255
 kernel_connect+0x141/0x1c0 net/socket.c:3755
 rfcomm_session_create net/bluetooth/rfcomm/core.c:808 [inline]
 __rfcomm_dlc_open net/bluetooth/rfcomm/core.c:385 [inline]
 rfcomm_dlc_open+0x644/0x1080 net/bluetooth/rfcomm/core.c:428
 rfcomm_sock_connect+0x2ed/0x650 net/bluetooth/rfcomm/sock.c:421
 connect_socket net/socket.c:2141 [inline]
 __sys_connect_file net/socket.c:2166 [inline]
 __sys_connect+0x316/0x450 net/socket.c:2183
 __do_sys_connect net/socket.c:2189 [inline]
 __se_sys_connect net/socket.c:2186 [inline]
 __x64_sys_connect+0x7a/0x90 net/socket.c:2186
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f33f179e159
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffd1579d778 EFLAGS: 00000246 ORIG_RAX: 000000000000002a
RAX: ffffffffffffffda RBX: 00007f33f1a25fa0 RCX: 00007f33f179e159
RDX: 000000000000000a RSI: 00002000000003c0 RDI: 0000000000000004
RBP: 00007f33f1835024 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f33f1a25fac R14: 00007f33f1a25fa0 R15: 00007f33f1a25fa0
 </TASK>