Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4 Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2 Bluetooth: hci6: command tx timeout Bluetooth: hci6: command tx timeout Bluetooth: hci6: command tx timeout unregister_netdevice: waiting for wlan1 to become free. Usage count = -6 Bluetooth: hci6: command tx timeout wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 Zero length message leads to an empty skb Oops: general protection fault, probably for non-canonical address 0xdffffc001fffffff: 0000 [#1] SMP KASAN NOPTI KASAN: probably user-memory-access in range [0x00000000fffffff8-0x00000000ffffffff] CPU: 0 UID: 0 PID: 14 Comm: ksoftirqd/0 Tainted: G W 6.17.0-rc4-next-20250901 #1 PREEMPT(voluntary) Tainted: [W]=WARN Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 RIP: 0010:dst_dev_put+0x21/0x250 Code: 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 41 54 55 53 48 89 fb e8 f0 9a a8 fd 48 89 da 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 <80> 3c 02 00 0f 85 b5 01 00 00 48 8d 7b 3a 48 8b 2b 48 b8 00 00 00 RSP: 0018:ffff888009617bf0 EFLAGS: 00010217 RAX: dffffc0000000000 RBX: 00000000fffffffe RCX: ffffffff841076c7 RDX: 000000001fffffff RSI: ffffffff83cb5bc0 RDI: 00000000fffffffe RBP: dffffc0000000000 R08: 0000000000000001 R09: 0000000000000001 R10: 0000000000000000 R11: 0000000000000001 R12: fffffbfff0b0a4ac R13: 0000607f1a633cd8 R14: 0000607f1a633cd8 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff8880e55d8000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000558062d01de0 CR3: 0000000038c5b000 CR4: 0000000000350ef0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600 Call Trace: rt_fibinfo_free_cpus.part.0+0xdb/0x1a0 fib_nh_common_release+0xa8/0x2c0 fib6_info_destroy_rcu+0x18b/0x1f0 rcu_core+0x7c8/0x1800 handle_softirqs+0x1b1/0x770 run_ksoftirqd+0x2e/0x60 smpboot_thread_fn+0x41d/0x9d0 kthread+0x3c8/0x740 ret_from_fork+0x34b/0x430 ret_from_fork_asm+0x1a/0x30 Modules linked in: ---[ end trace 0000000000000000 ]--- RIP: 0010:dst_dev_put+0x21/0x250 Code: 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 41 54 55 53 48 89 fb e8 f0 9a a8 fd 48 89 da 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 <80> 3c 02 00 0f 85 b5 01 00 00 48 8d 7b 3a 48 8b 2b 48 b8 00 00 00 RSP: 0018:ffff888009617bf0 EFLAGS: 00010217 RAX: dffffc0000000000 RBX: 00000000fffffffe RCX: ffffffff841076c7 RDX: 000000001fffffff RSI: ffffffff83cb5bc0 RDI: 00000000fffffffe RBP: dffffc0000000000 R08: 0000000000000001 R09: 0000000000000001 R10: 0000000000000000 R11: 0000000000000001 R12: fffffbfff0b0a4ac R13: 0000607f1a633cd8 R14: 0000607f1a633cd8 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff8880e55d8000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000558062d01de0 CR3: 0000000038c5b000 CR4: 0000000000350ef0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600 ---------------- Code disassembly (best guess): 0: 90 nop 1: 90 nop 2: 90 nop 3: 90 nop 4: 90 nop 5: 90 nop 6: 90 nop 7: 90 nop 8: 90 nop 9: f3 0f 1e fa endbr64 d: 41 54 push %r12 f: 55 push %rbp 10: 53 push %rbx 11: 48 89 fb mov %rdi,%rbx 14: e8 f0 9a a8 fd callq 0xfda89b09 19: 48 89 da mov %rbx,%rdx 1c: 48 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%rax 23: fc ff df 26: 48 c1 ea 03 shr $0x3,%rdx * 2a: 80 3c 02 00 cmpb $0x0,(%rdx,%rax,1) <-- trapping instruction 2e: 0f 85 b5 01 00 00 jne 0x1e9 34: 48 8d 7b 3a lea 0x3a(%rbx),%rdi 38: 48 8b 2b mov (%rbx),%rbp 3b: 48 rex.W 3c: b8 .byte 0xb8 3d: 00 00 add %al,(%rax)