Extracting prog: 4m37.189082662s Minimizing prog: 7m58.408744749s Simplifying prog options: 4m42.853961416s Extracting C: 1m47.224441851s Simplifying C: 0s extracting reproducer from 30 programs first checking the prog from the crash report single: executing 1 programs separately with timeout 30s testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$packet-syz_init_net_socket$bt_sco-connect$bt_sco detailed listing: executing program 0: socket$packet(0x11, 0x2, 0x300) r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) connect$bt_sco(r0, &(0x7f0000009e00)={0x1f, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}}, 0x8) program did not crash single: failed to extract reproducer bisect: bisecting 30 programs with base timeout 30s testing program (duration=37s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [3, 14, 3, 3, 3, 3, 3, 26, 3, 3, 3, 3, 3, 23, 3, 14, 3, 14, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 4] detailed listing: executing program 4: r0 = openat$dm_control(0xffffffffffffff9c, &(0x7f0000000280), 0x183641, 0x0) ioctl$DM_DEV_CREATE(r0, 0xc138fd03, &(0x7f0000000540)={0x4, 0x0, 0x0, 0x138, 0x138, 0x0, 0x0, 0x28c11, 0x0, 0x0, {0x0, {'syz', 0x0, '2\x00'}, @uuid={'CRP-syz', 0x0, '0\x00'}}}) ioctl$DM_TABLE_LOAD(r0, 0xc138fd09, &(0x7f0000000680)={0x4, 0x0, 0x0, 0x190, 0x138, 0x1, 0x0, 0x0, 0x0, 0x0, @by_dev={r1}, [@integrity={0x0, 0x146c, 0x0, 0x58, 'integrity\x00', {{@ram_num={'1:', 0x0}, 0x20, '128'}, 0x20, '8', 0x20, 'J', ' 1 fix_padding'}}]}) executing program 4: r0 = socket$alg(0x26, 0x5, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000040)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000080)=0x7) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f0000000100)=@abs={0x0, 0x0, 0x4e24}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000180), 0x651, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x6) sendto(r0, 0x0, 0x0, 0x24000040, &(0x7f0000000280)=@hci={0x1f, 0x0, 0x3}, 0x80) ioctl$IOCTL_VMCI_CTX_GET_CPT_STATE(0xffffffffffffffff, 0x7b1, 0x0) socket$tipc(0x1e, 0x5, 0x0) r4 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000300), 0x2, 0x0) write$apparmor_current(r4, &(0x7f0000000340)=ANY=[@ANYBLOB='stack ::'], 0xf4) executing program 1: r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, 0x0) ioctl$LOOP_CTL_GET_FREE(r0, 0x4c82) executing program 1: syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000440)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004eaffffff1e0006031a000008048002000905811765"], 0x0) r0 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) fsync(r0) executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000000c0)={'team_slave_1\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000740)={0x0, 0x0, &(0x7f0000000780)={&(0x7f00000007c0)=ANY=[@ANYBLOB="1c0000005e0001002bbd7000ffdbdf2500000000", @ANYRES32=r1, @ANYBLOB="06"], 0x1c}}, 0x20024090) executing program 0: r0 = syz_mount_image$ext4(&(0x7f0000000180)='ext4\x00', &(0x7f0000000080)='./file0\x00', 0x0, &(0x7f00000001c0)={[{@block_validity}, {@debug}, {@debug_want_extra_isize={'debug_want_extra_isize', 0x3d, 0x4}}, {@discard}, {@prjquota}]}, 0x1, 0x4ae, &(0x7f0000001040)="$eJzs20toXFUfAPD/vXm0/fpIvn791Naq0SIExaRJq3bhQkVBpKKgi4qrmExL6LSRJIotxUaRuhGkoOviUnTh2p0ooq4Et7pxJYWi3bR1IZF75948pjNNm04yMfn9YDLn3HvmnvOf+zr3nEwAG1Zf9ieJ2BYRv0RETy27uEBf7e3q5TOj1y6fGU1idvblP5K83JXLZ0bLouXnthaZ/jQifT8pKlls6tTp4yPVamWyyA9On3hjcOrU6UfeOjFyrHKscnL40KbGLU6S5cSZxXVlzzsTe3c/9+r5F0aPnH/9hy+yDW0r1i+Mo1X6ssD/nM3Vr3uw1ZW12fYF6aSzjQ3hlnRERLa7uvLzvyc6Yn7n9cSz77W1ccCKyu5NTW60mZlZYB1LYtkfLbv8LW0PsFrKG332/Fu+VqXjsUZceqr2AJTFfbV41dZ0RlqU6ap7vm2lvog4MvPXhewVKzQOAQCw0Iejnxzujpjtufb581nfo2duTRp35O+/5X93FHMovRHx34jYGRH/i4hdEfH/iLzsnRFx140q+3Lp9lzf/0kvLi+ym5P1/54o5rYW9//K3l/0dhS57Xn8XcnR8Wplf/Gd9EfXpiw/dIM6vn7m54+arVvY/8teWf1H0rgwXyK92Fk3QDc2Mj2Sd0pb4NK7EXs6G8WfzM0EZA/5uyNiz61tekeZGH/os73NCjWMv+gLL6kF80yzn2bhzWTxz0Rd/KVk4fzk+Nz85KGDB4Yef2z40cHNUa3sHyyPiuv9+NO5l5rV3zT+VZpDu1SpvS/Y//VFepP5L6MyOXXrdZz79YOmzzRL7/+Gx3/anbySzzN3F8veHpmenhyK6E4O5/lFy4e75z5by9fe06Ha8d+/r/H5v7P4TBb83RGRHcT3RMS9T0bcV7T9/oh4ICL23SD+759uvq6MP9JlHP8tkMU/1vD6N3f8Z/t/fr5+GYmO49991az+m9v/B/NUf7Ekv/4toVFzslOqvoG3890BAADAv0Wa/w98kg7MpdN0YGBzPrayK/6TViemph8+OvHmybHa/8r3RldajnT1FOOh1fFqZSiZKbZYGx8dLsaKy/HSA8W48ccdW/L8wOhEdazNscNGt7Xh+V9b93tHu1sHrLAtDZcumDMB1rH6ueZ0cfbsi+FiAOuV32vDxtXk/C8Xp6vZFmB1Lff+/1qL2wGsvkbn/9m6vLkAWJ88/8PG5fyHDSr9pt0tANrI/R82pNv5Xf8KJjZPTn27tlu4gok1HXJEmUiXKPz37Fpp8wZLbIpWbKfNFyYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAW+ScAAP//ck3ZyA==") mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./dev\x00', 0x1ff) ioctl$FS_IOC_SET_ENCRYPTION_POLICY(r0, 0x800c6613, &(0x7f0000000040)=@v1={0x0, @adiantum, 0x1, @auto="790cd163d4fe9889"}) executing program 3: r0 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000001840), 0x2982, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/vmstat\x00', 0x0, 0x0) sendfile(r0, r1, 0x0, 0x20000023896) executing program 4: socket$inet_udplite(0x2, 0x2, 0x88) r0 = socket$inet6(0xa, 0x80002, 0x88) bind$inet6(r0, &(0x7f0000001a80)={0xa, 0x4e21, 0x7f5, @mcast2, 0x3}, 0x1c) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f00000024c0)='net/udplite\x00') read$FUSE(r1, &(0x7f0000002500)={0x2020}, 0x2020) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(r2, 0x29, 0xb, &(0x7f0000000000)=0x8, 0x4d) bind$inet6(r2, &(0x7f0000000280)={0xa, 0x4e22, 0x7, @loopback, 0x6}, 0x1c) r3 = socket$nl_route(0x10, 0x3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/functions/uac2.0\x00', 0x1ff) r4 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./config/usb_gadget/g1/functions/uac2.0/c_chmask\x00', 0x2, 0x0) write(r4, &(0x7f0000000540)='0', 0x1) symlinkat(&(0x7f0000000280)='./config/usb_gadget/g1/functions/uac2.0\x00', 0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/configs/c.1/uac2.0\x00') r5 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0) write(r5, &(0x7f0000000340)='dummy_udc.0', 0xb) sendmsg$nl_route(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB, @ANYRES32=0x0, @ANYBLOB], 0x44}}, 0x24) getsockopt$inet6_buf(r2, 0x29, 0x6, 0x0, &(0x7f0000000180)) close(r2) listen(r2, 0x8) syz_mount_image$erofs(&(0x7f0000000180), &(0x7f00000001c0)='./file1\x00', 0x0, &(0x7f0000000900)=ANY=[], 0x1, 0x197, &(0x7f0000000200)="$eJzsmD9P8lAUxp/bAg1v3oR3fV00kQQcLG1Ro4MDs4MmGo2bRCpBixjoAGx+Cmc/gTNx4XvooE4O4ubkUHPbW3tFFAb/YDy/4fS5pyeXcw/Jc5OCIIhfy831w9VZJp3k+i/S0ET+Vo1qFKm+k3qcuaisnp8Y95ed7grr348nPE8b+fdjALoFFa5Ye57nye/T4rkBJdRx+f0WGHShd6BgU2gbDNtC70u6xut1fa/i2PpuzSlxYfBg8mDxkO/vr3fMUJL6kw/daLUPio5j1z9RDJtfr6BgWepP/r/C2RjR/GBCgSl0HgzrQi9CC2cTjEQ6/0Qs2l/94vP/bPE/NaQmjnFplcT7go1SzMDFXRIYi56/TUT+5J0yZCR/ikn+kXOrR7lGqz1bqRbLdtk+tKz8gjFnGPNWzjeiIA5wvvAaSPr+9EfaP/6GVyZYAs2i69bNID6vraYGt24NctyE738KstNB10zkZPz74B+b4o+sKtYEQRAEQRAEQRAEQRAEQRAfziSY/xX0BUuvUtaaX/0UAAD//xCocH4=") bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x9, 0x1, 0x4, 0x1, 0x0, 0xffffffffffffffff, 0x1}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x1, 0xd, 0x0, &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x38, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) executing program 1: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000900)={0x0, 0x0, &(0x7f0000000940)={&(0x7f0000000980)=ANY=[@ANYBLOB="6000000002060300000000000000000007000000140007800500150002000000080012400000000414000300686173683a69702c706f72742c697000050005000200000005000400050000000900020073797a31000000000500010007"], 0x60}, 0x1, 0x0, 0x0, 0x810}, 0x20004040) sendmsg$IPSET_CMD_ADD(r0, &(0x7f0000000a00)={0x0, 0x0, &(0x7f0000000a40)={&(0x7f0000000a80)=ANY=[@ANYBLOB="5c000000090603417c17da00000000000a000000340007800c000180080001407f0000010c00148008000140ac1e01010600044050000000060005406b640000050007000600000005000100060000000900020073797a31"], 0x5c}, 0x1, 0x0, 0x0, 0x810}, 0x20004000) executing program 1: unshare(0xa020480) r0 = socket$kcm(0x2, 0x200000000000001, 0x106) setsockopt$sock_int(r0, 0x1, 0x29, 0x0, 0x0) executing program 4: r0 = syz_open_procfs(0x0, &(0x7f0000002140)='fdinfo\x00') lseek(r0, 0x3, 0x2) getdents64(r0, 0xffffffffffffffff, 0x18) executing program 0: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000600)={0x26, 'rng\x00', 0x0, 0x0, 'drbg_pr_ctr_aes256\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000000c0)="b9da06ce17", 0x5) executing program 1: r0 = openat$dm_control(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) ioctl$DM_DEV_CREATE(r0, 0xc138fd03, &(0x7f0000000100)={0x4, 0x0, 0x0, 0x138, 0x138, 0x0, 0x0, 0x8800, 0x0, 0x0, {0x0, {'syz', 0x0, '3\x00'}, @uuid={'CRP-syz', 0x0, '0\x00'}}}) ioctl$DM_TABLE_LOAD(r0, 0xc138fd09, &(0x7f0000000300)={0x4, 0x0, 0x0, 0x1c0, 0x138, 0x1, 0x0, 0x2dc00, 0x0, 0x0, @by_dev={r1}, [@thin_pool={0x0, 0x8, 0x0, 0x88, 'thin-pool\x00', {@ram_num={'1:', 0x0}, 0x20, @ram_num={'1:', 0x1}, 0x20, '2048', 0x20, 0xf, ' 1 no_discard_passdown'}}]}) executing program 3: socket$nl_route(0x10, 0x3, 0x0) clock_gettime(0x4, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./gadget/dummy_udc\x00', 0x2, 0x0) write(r0, &(0x7f0000000480)="000000000902190001010080320904000001ff0020002a05810240000009023209040000", 0x24) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000500)={'veth0_to_hsr\x00', 0x8000}) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) futex$unlock_wake_list32(0x0, 0x601, 0x0, 0x0, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./tracing\x00', 0x1ff) mount(0x0, &(0x7f00000001c0)='./tracing\x00', &(0x7f0000000340)='tracefs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f00000003c0)='./tracing/per_cpu/cpu0/trace_pipe_raw\x00', 0x0, 0x0) close(0x3) getsockopt$inet6_tcp_buf(0xffffffffffffffff, 0x6, 0x1f, &(0x7f0000000980)=""/152, &(0x7f0000000000)=0x98) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./sys_sec\x00', 0x16e) mount(0x0, &(0x7f0000000040)='./sys_sec\x00', &(0x7f0000000080)='securityfs\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys_sec/tomoyo/domain_policy\x00', 0x2, 0x0) read(r2, &(0x7f0000000100)=""/9, 0xfffffd87) write$tun(r2, &(0x7f00000001c0)=ANY=[], 0xffe) executing program 4: r0 = openat$dm_control(0xffffffffffffff9c, &(0x7f0000000400), 0x543, 0x0) ioctl$DM_DEV_CREATE(r0, 0xc138fd03, &(0x7f0000000500)={0x4, 0x0, 0x0, 0x138, 0x138, 0x0, 0x0, 0x8800, 0x0, 0x0, {0x0, {'syz', 0x0, '3\x00'}, @uuid={'LVM-syz', 0x0, '1\x00'}}}) ioctl$DM_TABLE_LOAD(r0, 0xc138fd09, &(0x7f0000000800)={0x4, 0x0, 0x0, 0x1b8, 0x138, 0x1, 0x0, 0x9c00, 0x0, 0x0, @by_dev={r1}, [@flakey={0x0, 0x48, 0x0, 0x80, 'flakey\x00', {{@ram_num={'1:', 0x0}, 0x20, '128'}, 0x20, 0x2, 0x20, 0x1, ' 1 error_writes'}}]}) executing program 1: r0 = socket$alg(0x26, 0x5, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000040)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000080)=0x7) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff}) connect$unix(r2, &(0x7f0000000100)=@abs={0x0, 0x0, 0x4e24}, 0x6e) recvmmsg(r2, &(0x7f00000001c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x6) sendto(r0, 0x0, 0x0, 0x24000040, &(0x7f0000000280)=@hci={0x1f, 0x0, 0x3}, 0x80) ioctl$IOCTL_VMCI_CTX_GET_CPT_STATE(0xffffffffffffffff, 0x7b1, 0x0) socket$tipc(0x1e, 0x5, 0x0) r3 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000300), 0x2, 0x0) write$apparmor_current(r3, &(0x7f0000000340)=ANY=[@ANYBLOB='stack ::'], 0xf4) executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000200)={0x0, 0x18, 0xfa00, {0x5, &(0x7f0000000340)={0xffffffffffffffff}, 0x2, 0x1}}, 0x20) write$RDMA_USER_CM_CMD_MIGRATE_ID(r0, &(0x7f0000000480)={0x12, 0x10, 0xfa00, {&(0x7f0000001640), r1, r0}}, 0x18) executing program 4: r0 = socket$alg(0x26, 0x5, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000040)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000080)=0x7) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f0000000100)=@abs={0x0, 0x0, 0x4e24}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000180), 0x651, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x6) sendto(r0, 0x0, 0x0, 0x24000040, &(0x7f0000000280)=@hci={0x1f, 0x0, 0x3}, 0x80) ioctl$IOCTL_VMCI_CTX_GET_CPT_STATE(0xffffffffffffffff, 0x7b1, 0x0) socket$tipc(0x1e, 0x5, 0x0) r4 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000300), 0x2, 0x0) write$apparmor_current(r4, &(0x7f0000000340)=ANY=[@ANYBLOB='stack ::'], 0xf4) executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000004140)={0x1f, 0xffff, 0x3}, 0x6) write(r0, &(0x7f0000004500)="3e0000000b000100"/17, 0x11) executing program 2: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000580)=@base={0x1b, 0x0, 0x0, 0x8000, 0x0, 0xffffffffffffffff, 0x1}, 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x3, 0x14, &(0x7f0000000340)=@framed={{}, [@printk={@lld, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x71}}, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, r0}}]}, &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r1, 0x0, 0x10, 0x10, &(0x7f00000002c0)="0000ffffffffa000", &(0x7f0000000300)=""/8, 0xa00, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x4c) executing program 2: unshare(0x22020600) r0 = openat$random(0xffffffffffffff9c, &(0x7f0000000100), 0x40, 0x0) ppoll(&(0x7f0000000140)=[{r0, 0x1302}], 0x1, &(0x7f00000001c0)={0x0, 0x3938700}, 0x0, 0x0) executing program 3: syz_mount_image$hfsplus(&(0x7f0000000000), &(0x7f0000000040)='./file1\x00', 0x4810, &(0x7f0000000080)=ANY=[], 0x14, 0x693, &(0x7f0000000480)="$eJzs3c1vHGcdB/DvrNcvm0qO26ZpQJUwjVQQEYkdK4VwSUAIBalCVThwthqnseKkwXFR2gNxAYkrB/6AcggXOIEQEhJSpHKGW8XN4lQJiUtPaQ8MmtlZe+3u2ptXO/TziWaf55ln5pnf/OZlXyJrAnxuXTiR9t10cuHEa7eq9sadhZWNOwvXevUkk0laSbtbpLieFB8k59Od8oVqZjNcMWw7v14+e/HDjzc+6rba2RqveukMD7A9yl6sN1Nmk4w15UPYNt4bDzbe5Fa12MxMlbDjvcTBfhtPUm7z46NbPYOUY32Nodc78PQouu+bfbrX/0xyKMlU7w1tvdvZevIR7um+7kXrjy8OAAAAODAO37ud3Mr0fscBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAT5Pm+f9FM7V69dkUvef/T/Q9Y39in8MdbvfIpnqVu60nEQwAAAAAAAAAPF5fupffXSzL6V67LOr/83+5bhypX5/J27mZpazmZG5lMWtZy2rmk8z0DTRxa3FtbXW+t+anZVkOWfP0wDVPjxhw51HsNQAAAAAAAAD83zjXlD/LhUzvcywAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAALBNkYx1i3o60qvPpNVOMpVkolpuPflHr/40u7vfAQAAAMATcPhe7uVWpnvtsqi/8x+tv/dP5e1cz1qWs5aVLOVS/VtA91t/a+POwsrGnYVr1fTZcb/9n636H6f3DKMeMd3fHgZv+Vi9RCeXs1zPOZk38lZWcimtes3KsV48g+N6r4qpONdVlqMl6FJTVnv+q6Y8GGbqjIxvZmSuia3KxrO7Z6L/6DzAlubT2vzl58h95Pzcrlsp/ts7Jod6c5Jnvr93zsfva2ceys5MnO47+47unonkK3/6/Y+urFy/eqVYP3FwTqP7MPmvratmZyYW+jLx4siZuHzz6czETq28sFm/kO/lhzmR2bye1SznJ1nMWpYym+/WtcXmfK5eZ3bP1Pltrdf3imKiOS5jO2L68uFuuVtML9frTmc5P8hbuZSlvFr/O535fCNnciZn+47wCyNc9a0BV/2fhwd//KtNpZPkl015MFR5fbYvr/333Jm6r39OK+Vkd73nHtm9cVP7i02lOhI/b8qDYTMTU9l8l+hF93wvA+MDM/Gb+rZyc+X61dUrizd2jFusD97eK9m++wfnRlKdL89VB6tubT87qr7nB/bN131HNvtaO/t+29ns2+tKnWg+w312pNN134sD+xbqvmN9fVuftz4ty7L7eQuAA+/Q1w5NdP7d+Xvn/c4vOlc6r019Z/Kbky9NZPxv499qz4290nqp+EPez0+z9zd0AAAAAAAAAAAAAAAAAAAAAAAAAAAAAABgTzffeffq4srK0uqOSlmWt4d0PZZK2sm2OX/9S98ySeqHAY0+YLX0+VZSz2mnqdxfYLcfbHfee9Ak/LM5Jk8k4Y+kMjX0/NlZ+aQsy4MR8yiVsnFQ4tmPyr7eloAn4NTatRunbr7z7teXry2+ufTm0vWzZ86cnTt75tWFU5eXV5bmuq/7HSXwOPR9AgcAAAAAAAAAAACeEqP9cU7xcH/bAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAPAQLpxI+26KzM+dnKvaG3cWVqqpV99a8pMkrSTFbFJ8kJxPd8pM33DFsO2sJxc//Hjjo26r3Uz18q3d1hvNejNlNslYUw4wNWhmeXvYeEU9zo3h442o2NzDKmHHe4mD/fa/AAAA///tbhq7") r0 = openat(0xffffffffffffff9c, &(0x7f0000002280)='./file1\x00', 0x42, 0x0) pwrite64(r0, &(0x7f00000022c0)='a', 0x200000c1, 0x9000) executing program 0: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000580)=@base={0xe, 0x4, 0x8, 0x7}, 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0xc, 0xd, &(0x7f00000006c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0xaa9a}, [@ringbuf_output={{0x18, 0x5, 0x1, 0x0, r0}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x7ffffffd}, {0x3, 0x3, 0x3, 0xa, 0x5}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}, {0x85, 0x0, 0x0, 0x15}}, @call={0x85, 0x0, 0x0, 0xa0}]}, &(0x7f0000000740)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x2e, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000780)={r1, 0x18000000000002a0, 0xe, 0x0, &(0x7f0000000800)="76ea090000000000009ba56a88ca", 0x0, 0x6400, 0x60000000, 0x0, 0x0, 0x0, 0x0}, 0x50) executing program 2: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000100)={0x30, r1, 0x1, 0x70bd2c, 0x25dfdbfb, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x100000001}, @NL802154_ATTR_CHANNEL={0x5, 0x8, 0x4}, @NL802154_ATTR_PAGE={0x5}]}, 0x30}, 0x1, 0x0, 0x0, 0x4000}, 0x4000884) executing program 2: r0 = io_uring_setup(0x650b, &(0x7f0000000180)={0x0, 0x2c3f, 0x0, 0x21, 0xab}) fsopen(&(0x7f0000000000)='fusectl\x00', 0x0) close_range(r0, 0xffffffffffffffff, 0x0) executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000600)={&(0x7f00000008c0)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x40001}, 0x4040850) sendmsg$NFT_BATCH(r0, &(0x7f0000000940)={0x0, 0x0, &(0x7f0000000980)={&(0x7f00000009c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x7}}, [@NFT_MSG_NEWCHAIN={0x38, 0x3, 0xa, 0x3, 0x0, 0x0, {0xa, 0x0, 0x7}, [@NFTA_CHAIN_NAME={0x9, 0x3, 'syz0\x00'}, @NFTA_CHAIN_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_CHAIN_HANDLE={0xc, 0x2, 0x1, 0x0, 0x1}]}], {0x14}}, 0x60}, 0x1, 0x0, 0x0, 0x4000850}, 0x24000840) executing program 2: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000300)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x301, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x40, 0x3, 0xa, 0x201, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_NAME={0x9, 0x3, 'syz1\x00'}, @NFTA_CHAIN_HOOK={0x14, 0x4, 0x0, 0x1, [@NFTA_HOOK_PRIORITY={0x8}, @NFTA_HOOK_HOOKNUM={0x8}]}, @NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWRULE={0x60, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_EXPRESSIONS={0x38, 0x4, 0x0, 0x1, [{0x34, 0x1, 0x0, 0x1, @limit={{0xa}, @val={0x24, 0x2, 0x0, 0x1, [@NFTA_LIMIT_UNIT={0xc, 0x2, 0x1, 0x0, 0x80000001}, @NFTA_LIMIT_RATE={0xc, 0x1, 0x1, 0x0, 0x8}, @NFTA_LIMIT_TYPE={0x8}]}}}]}]}], {0x14}}, 0xe8}}, 0x0) syz_emit_ethernet(0x46, &(0x7f00000001c0)={@broadcast, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x1, 0x31, 0x38, 0x65, 0x0, 0x9, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @remote}, @source_quench={0x4, 0x0, 0x0, 0x0, {0x5, 0x4, 0x1, 0x9, 0xe189, 0x65, 0x174, 0xd, 0x73, 0x6, @loopback, @initdev={0xac, 0x1e, 0x0, 0x0}}, "b939798a90c034c1"}}}}}, 0x0) executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IPT_SO_SET_REPLACE(r0, 0x0, 0x40, &(0x7f0000000000)=@filter={'filter\x00', 0xe, 0x4, 0x260, 0xffffffff, 0x0, 0x130, 0x1c8, 0xffffffff, 0xffffffff, 0x98, 0x130, 0x1c8, 0xffffffff, 0x4, 0x0, {[{{@ip={@empty, @empty, 0x0, 0x0, '\x00', '\x00', {}, {}, 0x6}, 0x0, 0x70, 0x98}, @common=@inet=@SYNPROXY={0x28, 'SYNPROXY\x00', 0x0, {0xf, 0x7, 0x5b4}}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x2c0) syz_emit_ethernet(0x5e, &(0x7f00000002c0)={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}, @broadcast, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x10, 0x50, 0x0, 0x0, 0xc0, 0x6, 0x0, @initdev={0xac, 0x1e, 0x1, 0x0}, @local}, {{0x1000, 0x2000, 0x1, 0x41424344, 0x0, 0x0, 0xf, 0x10, 0x40, 0x0, 0x0, {[@exp_smc={0xfe, 0x6}, @timestamp={0x8, 0xa, 0x2, 0xe7b0}, @md5sig={0x13, 0x12, "48be668c87c7e265e3d9eea698e372bd"}, @sack_perm={0x4, 0x2}, @generic={0x2, 0x2}]}}}}}}}, 0x0) executing program 0: socket$packet(0x11, 0x2, 0x300) r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) connect$bt_sco(r0, &(0x7f0000009e00)={0x1f, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}}, 0x8) executing program 2: r0 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r0, &(0x7f0000000480)={0x2, 0x4e24, @local}, 0x10) setsockopt$IP_VS_SO_SET_ADDDEST(r0, 0x0, 0x487, 0x0, 0x0) sendmmsg$sock(r0, &(0x7f00000005c0)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)=[@mark={{0x10, 0x1, 0x24, 0x1}}], 0x10}}], 0x1, 0x20000000) program did not crash replaying the whole log did not cause a kernel crash single: executing 1 programs separately with timeout 1m40s testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$packet-syz_init_net_socket$bt_sco-connect$bt_sco detailed listing: executing program 0: socket$packet(0x11, 0x2, 0x300) r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) connect$bt_sco(r0, &(0x7f0000009e00)={0x1f, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}}, 0x8) program crashed: possible deadlock in sco_conn_del single: successfully extracted reproducer found reproducer with 3 syscalls minimizing guilty program testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$packet-syz_init_net_socket$bt_sco detailed listing: executing program 0: socket$packet(0x11, 0x2, 0x300) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$packet-connect$bt_sco detailed listing: executing program 0: socket$packet(0x11, 0x2, 0x300) connect$bt_sco(0xffffffffffffffff, &(0x7f0000009e00)={0x1f, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}}, 0x8) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$bt_sco-connect$bt_sco detailed listing: executing program 0: r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) connect$bt_sco(r0, &(0x7f0000009e00)={0x1f, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}}, 0x8) program crashed: possible deadlock in sco_conn_del testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$bt_sco-connect$bt_sco detailed listing: executing program 0: r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) connect$bt_sco(r0, 0x0, 0x0) program did not crash extracting C reproducer testing compiled C program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$bt_sco-connect$bt_sco program did not crash simplifying guilty program options testing program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$bt_sco-connect$bt_sco detailed listing: executing program 0: r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) connect$bt_sco(r0, &(0x7f0000009e00)={0x1f, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}}, 0x8) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$bt_sco-connect$bt_sco detailed listing: executing program 0: r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) connect$bt_sco(r0, &(0x7f0000009e00)={0x1f, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}}, 0x8) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$bt_sco-connect$bt_sco detailed listing: executing program 0: r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) connect$bt_sco(r0, &(0x7f0000009e00)={0x1f, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}}, 0x8) program crashed: possible deadlock in sco_conn_del validation run: crashed=true testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$bt_sco-connect$bt_sco detailed listing: executing program 0: r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) connect$bt_sco(r0, &(0x7f0000009e00)={0x1f, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}}, 0x8) program did not crash validation run: crashed=false testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$bt_sco-connect$bt_sco detailed listing: executing program 0: r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) connect$bt_sco(r0, &(0x7f0000009e00)={0x1f, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}}, 0x8) program did not crash validation run: crashed=false testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$bt_sco-connect$bt_sco detailed listing: executing program 0: r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) connect$bt_sco(r0, &(0x7f0000009e00)={0x1f, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}}, 0x8) program crashed: possible deadlock in sco_conn_del validation run: crashed=true testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$bt_sco-connect$bt_sco detailed listing: executing program 0: r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) connect$bt_sco(r0, &(0x7f0000009e00)={0x1f, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}}, 0x8) program crashed: possible deadlock in sco_conn_del validation run: crashed=true reproducing took 26m32.448623146s repro crashed as (corrupted=false): ====================================================== WARNING: possible circular locking dependency detected syzkaller #0 Not tainted ------------------------------------------------------ syz-executor/4372 is trying to acquire lock: ffff88807d6e5120 (sk_lock-AF_BLUETOOTH-BTPROTO_SCO){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1744 [inline] ffff88807d6e5120 (sk_lock-AF_BLUETOOTH-BTPROTO_SCO){+.+.}-{0:0}, at: sco_conn_del+0x13e/0x350 net/bluetooth/sco.c:206 but task is already holding lock: ffffffff8e3b3c48 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_disconn_cfm include/net/bluetooth/hci_core.h:1519 [inline] ffffffff8e3b3c48 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_conn_hash_flush+0xa4/0x220 net/bluetooth/hci_conn.c:1622 which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #2 (hci_cb_list_lock){+.+.}-{3:3}: __mutex_lock_common+0x1e5/0x2400 kernel/locking/mutex.c:596 __mutex_lock kernel/locking/mutex.c:729 [inline] mutex_lock_nested+0x17/0x20 kernel/locking/mutex.c:743 hci_connect_cfm include/net/bluetooth/hci_core.h:1504 [inline] hci_remote_features_evt+0x5d9/0xa10 net/bluetooth/hci_event.c:3367 hci_event_packet+0x600/0x1310 net/bluetooth/hci_event.c:6455 hci_rx_work+0x255/0xa10 net/bluetooth/hci_core.c:5200 process_one_work+0x867/0xff0 kernel/workqueue.c:2310 worker_thread+0xad7/0x12a0 kernel/workqueue.c:2457 kthread+0x42e/0x520 kernel/kthread.c:334 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287 -> #1 (&hdev->lock){+.+.}-{3:3}: __mutex_lock_common+0x1e5/0x2400 kernel/locking/mutex.c:596 __mutex_lock kernel/locking/mutex.c:729 [inline] mutex_lock_nested+0x17/0x20 kernel/locking/mutex.c:743 sco_sock_connect+0x189/0x940 net/bluetooth/sco.c:608 __sys_connect_file net/socket.c:1933 [inline] __sys_connect+0x3cb/0x450 net/socket.c:1950 __do_sys_connect net/socket.c:1960 [inline] __se_sys_connect net/socket.c:1957 [inline] __x64_sys_connect+0x76/0x80 net/socket.c:1957 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x66/0xd0 -> #0 (sk_lock-AF_BLUETOOTH-BTPROTO_SCO){+.+.}-{0:0}: check_prev_add kernel/locking/lockdep.c:3120 [inline] check_prevs_add kernel/locking/lockdep.c:3239 [inline] validate_chain kernel/locking/lockdep.c:3855 [inline] __lock_acquire+0x38f7/0x7d40 kernel/locking/lockdep.c:5120 lock_acquire+0x19f/0x400 kernel/locking/lockdep.c:5737 lock_sock_nested+0x44/0x100 net/core/sock.c:3258 lock_sock include/net/sock.h:1744 [inline] sco_conn_del+0x13e/0x350 net/bluetooth/sco.c:206 hci_disconn_cfm include/net/bluetooth/hci_core.h:1522 [inline] hci_conn_hash_flush+0x107/0x220 net/bluetooth/hci_conn.c:1622 hci_dev_do_close+0x918/0x1020 net/bluetooth/hci_core.c:1813 hci_unregister_dev+0x2eb/0x590 net/bluetooth/hci_core.c:4072 vhci_release+0x73/0xc0 drivers/bluetooth/hci_vhci.c:345 __fput+0x212/0x8c0 fs/file_table.c:311 task_work_run+0x125/0x1a0 kernel/task_work.c:188 exit_task_work include/linux/task_work.h:33 [inline] do_exit+0x635/0x2100 kernel/exit.c:890 do_group_exit+0x12c/0x2f0 kernel/exit.c:1004 get_signal+0x7eb/0x12e0 kernel/signal.c:2917 arch_do_signal_or_restart+0xe6/0x12a0 arch/x86/kernel/signal.c:867 handle_signal_work kernel/entry/common.c:157 [inline] exit_to_user_mode_loop+0x9e/0x130 kernel/entry/common.c:181 exit_to_user_mode_prepare+0xee/0x180 kernel/entry/common.c:217 __syscall_exit_to_user_mode_work kernel/entry/common.c:299 [inline] syscall_exit_to_user_mode+0x16/0x40 kernel/entry/common.c:310 do_syscall_64+0x58/0xa0 arch/x86/entry/common.c:86 entry_SYSCALL_64_after_hwframe+0x66/0xd0 other info that might help us debug this: Chain exists of: sk_lock-AF_BLUETOOTH-BTPROTO_SCO --> &hdev->lock --> hci_cb_list_lock Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(hci_cb_list_lock); lock(&hdev->lock); lock(hci_cb_list_lock); lock(sk_lock-AF_BLUETOOTH-BTPROTO_SCO); *** DEADLOCK *** 3 locks held by syz-executor/4372: #0: ffff8880721fd3f0 (&hdev->req_lock){+.+.}-{3:3}, at: hci_dev_do_close+0x5f/0x1020 net/bluetooth/hci_core.c:1755 #1: ffff8880721fc478 (&hdev->lock){+.+.}-{3:3}, at: hci_dev_do_close+0x408/0x1020 net/bluetooth/hci_core.c:1800 #2: ffffffff8e3b3c48 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_disconn_cfm include/net/bluetooth/hci_core.h:1519 [inline] #2: ffffffff8e3b3c48 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_conn_hash_flush+0xa4/0x220 net/bluetooth/hci_conn.c:1622 stack backtrace: CPU: 1 PID: 4372 Comm: syz-executor Not tainted syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 Call Trace: dump_stack_lvl+0x188/0x250 lib/dump_stack.c:106 check_noncircular+0x2f8/0x400 kernel/locking/lockdep.c:2178 check_prev_add kernel/locking/lockdep.c:3120 [inline] check_prevs_add kernel/locking/lockdep.c:3239 [inline] validate_chain kernel/locking/lockdep.c:3855 [inline] __lock_acquire+0x38f7/0x7d40 kernel/locking/lockdep.c:5120 lock_acquire+0x19f/0x400 kernel/locking/lockdep.c:5737 lock_sock_nested+0x44/0x100 net/core/sock.c:3258 lock_sock include/net/sock.h:1744 [inline] sco_conn_del+0x13e/0x350 net/bluetooth/sco.c:206 hci_disconn_cfm include/net/bluetooth/hci_core.h:1522 [inline] hci_conn_hash_flush+0x107/0x220 net/bluetooth/hci_conn.c:1622 hci_dev_do_close+0x918/0x1020 net/bluetooth/hci_core.c:1813 hci_unregister_dev+0x2eb/0x590 net/bluetooth/hci_core.c:4072 vhci_release+0x73/0xc0 drivers/bluetooth/hci_vhci.c:345 __fput+0x212/0x8c0 fs/file_table.c:311 task_work_run+0x125/0x1a0 kernel/task_work.c:188 exit_task_work include/linux/task_work.h:33 [inline] do_exit+0x635/0x2100 kernel/exit.c:890 do_group_exit+0x12c/0x2f0 kernel/exit.c:1004 get_signal+0x7eb/0x12e0 kernel/signal.c:2917 arch_do_signal_or_restart+0xe6/0x12a0 arch/x86/kernel/signal.c:867 handle_signal_work kernel/entry/common.c:157 [inline] exit_to_user_mode_loop+0x9e/0x130 kernel/entry/common.c:181 exit_to_user_mode_prepare+0xee/0x180 kernel/entry/common.c:217 __syscall_exit_to_user_mode_work kernel/entry/common.c:299 [inline] syscall_exit_to_user_mode+0x16/0x40 kernel/entry/common.c:310 do_syscall_64+0x58/0xa0 arch/x86/entry/common.c:86 entry_SYSCALL_64_after_hwframe+0x66/0xd0 RIP: 0033:0x7f3bae1afd2a Code: Unable to access opcode bytes at RIP 0x7f3bae1afd00. RSP: 002b:00007ffe4d8df2f8 EFLAGS: 00000216 ORIG_RAX: 0000000000000037 RAX: 0000000000000000 RBX: 00007ffe4d8df380 RCX: 00007f3bae1afd2a RDX: 0000000000000041 RSI: 0000000000000000 RDI: 0000000000000003 RBP: 0000000000000003 R08: 00007ffe4d8df31c R09: 0000000000000000 R10: 00007ffe4d8df380 R11: 0000000000000216 R12: 00007f3bae405fc0 R13: 00007ffe4d8df31c R14: 0000000000000000 R15: 00007f3bae408180 final repro crashed as (corrupted=false): ====================================================== WARNING: possible circular locking dependency detected syzkaller #0 Not tainted ------------------------------------------------------ syz-executor/4372 is trying to acquire lock: ffff88807d6e5120 (sk_lock-AF_BLUETOOTH-BTPROTO_SCO){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1744 [inline] ffff88807d6e5120 (sk_lock-AF_BLUETOOTH-BTPROTO_SCO){+.+.}-{0:0}, at: sco_conn_del+0x13e/0x350 net/bluetooth/sco.c:206 but task is already holding lock: ffffffff8e3b3c48 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_disconn_cfm include/net/bluetooth/hci_core.h:1519 [inline] ffffffff8e3b3c48 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_conn_hash_flush+0xa4/0x220 net/bluetooth/hci_conn.c:1622 which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #2 (hci_cb_list_lock){+.+.}-{3:3}: __mutex_lock_common+0x1e5/0x2400 kernel/locking/mutex.c:596 __mutex_lock kernel/locking/mutex.c:729 [inline] mutex_lock_nested+0x17/0x20 kernel/locking/mutex.c:743 hci_connect_cfm include/net/bluetooth/hci_core.h:1504 [inline] hci_remote_features_evt+0x5d9/0xa10 net/bluetooth/hci_event.c:3367 hci_event_packet+0x600/0x1310 net/bluetooth/hci_event.c:6455 hci_rx_work+0x255/0xa10 net/bluetooth/hci_core.c:5200 process_one_work+0x867/0xff0 kernel/workqueue.c:2310 worker_thread+0xad7/0x12a0 kernel/workqueue.c:2457 kthread+0x42e/0x520 kernel/kthread.c:334 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287 -> #1 (&hdev->lock){+.+.}-{3:3}: __mutex_lock_common+0x1e5/0x2400 kernel/locking/mutex.c:596 __mutex_lock kernel/locking/mutex.c:729 [inline] mutex_lock_nested+0x17/0x20 kernel/locking/mutex.c:743 sco_sock_connect+0x189/0x940 net/bluetooth/sco.c:608 __sys_connect_file net/socket.c:1933 [inline] __sys_connect+0x3cb/0x450 net/socket.c:1950 __do_sys_connect net/socket.c:1960 [inline] __se_sys_connect net/socket.c:1957 [inline] __x64_sys_connect+0x76/0x80 net/socket.c:1957 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x66/0xd0 -> #0 (sk_lock-AF_BLUETOOTH-BTPROTO_SCO){+.+.}-{0:0}: check_prev_add kernel/locking/lockdep.c:3120 [inline] check_prevs_add kernel/locking/lockdep.c:3239 [inline] validate_chain kernel/locking/lockdep.c:3855 [inline] __lock_acquire+0x38f7/0x7d40 kernel/locking/lockdep.c:5120 lock_acquire+0x19f/0x400 kernel/locking/lockdep.c:5737 lock_sock_nested+0x44/0x100 net/core/sock.c:3258 lock_sock include/net/sock.h:1744 [inline] sco_conn_del+0x13e/0x350 net/bluetooth/sco.c:206 hci_disconn_cfm include/net/bluetooth/hci_core.h:1522 [inline] hci_conn_hash_flush+0x107/0x220 net/bluetooth/hci_conn.c:1622 hci_dev_do_close+0x918/0x1020 net/bluetooth/hci_core.c:1813 hci_unregister_dev+0x2eb/0x590 net/bluetooth/hci_core.c:4072 vhci_release+0x73/0xc0 drivers/bluetooth/hci_vhci.c:345 __fput+0x212/0x8c0 fs/file_table.c:311 task_work_run+0x125/0x1a0 kernel/task_work.c:188 exit_task_work include/linux/task_work.h:33 [inline] do_exit+0x635/0x2100 kernel/exit.c:890 do_group_exit+0x12c/0x2f0 kernel/exit.c:1004 get_signal+0x7eb/0x12e0 kernel/signal.c:2917 arch_do_signal_or_restart+0xe6/0x12a0 arch/x86/kernel/signal.c:867 handle_signal_work kernel/entry/common.c:157 [inline] exit_to_user_mode_loop+0x9e/0x130 kernel/entry/common.c:181 exit_to_user_mode_prepare+0xee/0x180 kernel/entry/common.c:217 __syscall_exit_to_user_mode_work kernel/entry/common.c:299 [inline] syscall_exit_to_user_mode+0x16/0x40 kernel/entry/common.c:310 do_syscall_64+0x58/0xa0 arch/x86/entry/common.c:86 entry_SYSCALL_64_after_hwframe+0x66/0xd0 other info that might help us debug this: Chain exists of: sk_lock-AF_BLUETOOTH-BTPROTO_SCO --> &hdev->lock --> hci_cb_list_lock Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(hci_cb_list_lock); lock(&hdev->lock); lock(hci_cb_list_lock); lock(sk_lock-AF_BLUETOOTH-BTPROTO_SCO); *** DEADLOCK *** 3 locks held by syz-executor/4372: #0: ffff8880721fd3f0 (&hdev->req_lock){+.+.}-{3:3}, at: hci_dev_do_close+0x5f/0x1020 net/bluetooth/hci_core.c:1755 #1: ffff8880721fc478 (&hdev->lock){+.+.}-{3:3}, at: hci_dev_do_close+0x408/0x1020 net/bluetooth/hci_core.c:1800 #2: ffffffff8e3b3c48 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_disconn_cfm include/net/bluetooth/hci_core.h:1519 [inline] #2: ffffffff8e3b3c48 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_conn_hash_flush+0xa4/0x220 net/bluetooth/hci_conn.c:1622 stack backtrace: CPU: 1 PID: 4372 Comm: syz-executor Not tainted syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 Call Trace: dump_stack_lvl+0x188/0x250 lib/dump_stack.c:106 check_noncircular+0x2f8/0x400 kernel/locking/lockdep.c:2178 check_prev_add kernel/locking/lockdep.c:3120 [inline] check_prevs_add kernel/locking/lockdep.c:3239 [inline] validate_chain kernel/locking/lockdep.c:3855 [inline] __lock_acquire+0x38f7/0x7d40 kernel/locking/lockdep.c:5120 lock_acquire+0x19f/0x400 kernel/locking/lockdep.c:5737 lock_sock_nested+0x44/0x100 net/core/sock.c:3258 lock_sock include/net/sock.h:1744 [inline] sco_conn_del+0x13e/0x350 net/bluetooth/sco.c:206 hci_disconn_cfm include/net/bluetooth/hci_core.h:1522 [inline] hci_conn_hash_flush+0x107/0x220 net/bluetooth/hci_conn.c:1622 hci_dev_do_close+0x918/0x1020 net/bluetooth/hci_core.c:1813 hci_unregister_dev+0x2eb/0x590 net/bluetooth/hci_core.c:4072 vhci_release+0x73/0xc0 drivers/bluetooth/hci_vhci.c:345 __fput+0x212/0x8c0 fs/file_table.c:311 task_work_run+0x125/0x1a0 kernel/task_work.c:188 exit_task_work include/linux/task_work.h:33 [inline] do_exit+0x635/0x2100 kernel/exit.c:890 do_group_exit+0x12c/0x2f0 kernel/exit.c:1004 get_signal+0x7eb/0x12e0 kernel/signal.c:2917 arch_do_signal_or_restart+0xe6/0x12a0 arch/x86/kernel/signal.c:867 handle_signal_work kernel/entry/common.c:157 [inline] exit_to_user_mode_loop+0x9e/0x130 kernel/entry/common.c:181 exit_to_user_mode_prepare+0xee/0x180 kernel/entry/common.c:217 __syscall_exit_to_user_mode_work kernel/entry/common.c:299 [inline] syscall_exit_to_user_mode+0x16/0x40 kernel/entry/common.c:310 do_syscall_64+0x58/0xa0 arch/x86/entry/common.c:86 entry_SYSCALL_64_after_hwframe+0x66/0xd0 RIP: 0033:0x7f3bae1afd2a Code: Unable to access opcode bytes at RIP 0x7f3bae1afd00. RSP: 002b:00007ffe4d8df2f8 EFLAGS: 00000216 ORIG_RAX: 0000000000000037 RAX: 0000000000000000 RBX: 00007ffe4d8df380 RCX: 00007f3bae1afd2a RDX: 0000000000000041 RSI: 0000000000000000 RDI: 0000000000000003 RBP: 0000000000000003 R08: 00007ffe4d8df31c R09: 0000000000000000 R10: 00007ffe4d8df380 R11: 0000000000000216 R12: 00007f3bae405fc0 R13: 00007ffe4d8df31c R14: 0000000000000000 R15: 00007f3bae408180