do_syscall_64+0xbf/0x360 entry_SYSCALL_64_after_hwframe+0x77/0x7f kmemleak: Automatic memory scanning thread ended Bluetooth: hci4: command tx timeout Bluetooth: hci4: command tx timeout Oops: general protection fault, probably for non-canonical address 0xdffffc0000000004: 0000 [#1] SMP KASAN NOPTI KASAN: null-ptr-deref in range [0x0000000000000020-0x0000000000000027] CPU: 0 UID: 0 PID: 1 Comm: systemd Tainted: G W 6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary) Tainted: [W]=WARN Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 RIP: 0010:css_rstat_flush+0x2b4/0x1b30 Code: 00 49 8d 7d 08 4d 89 6d 00 48 89 f8 48 c1 e8 03 42 80 3c 38 00 0f 85 29 0f 00 00 4d 8b 6d 08 49 8d 7d 20 48 89 f8 48 c1 e8 03 <42> 80 3c 38 00 0f 85 19 0f 00 00 48 8b 44 24 18 49 8b 6d 20 80 38 RSP: 0018:ffff888009547a80 EFLAGS: 00010012 RAX: 0000000000000004 RBX: ffff8880e55dd000 RCX: ffffffff824fcb97 RDX: ffff8880094f8000 RSI: ffffffff816cfaf9 RDI: 0000000000000023 RBP: ffffe8ffffc02a30 R08: 0000000000000001 R09: ffffed10012a8f42 R10: 0000000000000001 R11: 0000000000000001 R12: ffffe8ffffc02a38 R13: 0000000000000003 R14: ffffffff85c5b580 R15: dffffc0000000000 FS: 00007f1a7f69a900(0000) GS:ffff8880e55dd000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000055b9119c2408 CR3: 000000000bc30000 CR4: 0000000000350ef0 Call Trace: cgroup_base_stat_cputime_show+0xee/0x570 cpu_stat_show+0x1c/0x570 cgroup_seqfile_show+0xd5/0x1f0 seq_read_iter+0x513/0x1320 kernfs_fop_read_iter+0x425/0x5b0 vfs_read+0x868/0xc70 ksys_read+0x121/0x240 do_syscall_64+0xbf/0x360 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f1a7fe67ecc Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 c9 5e f9 ff 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 ff 5e f9 ff 48 RSP: 002b:00007ffe2e5e9ab0 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 RAX: ffffffffffffffda RBX: 000055b9118bcbf0 RCX: 00007f1a7fe67ecc RDX: 0000000000001000 RSI: 000055b911995e50 RDI: 0000000000000004 RBP: 00007f1a7ff394a0 R08: 0000000000000000 R09: 00007f1a7ff37be0 R10: 0000000000100000 R11: 0000000000000246 R12: 0000000000000800 R13: 00007f1a7ff388a0 R14: 0000000000000d68 R15: 0000000000000d68 Modules linked in: ---[ end trace 0000000000000000 ]--- RIP: 0010:css_rstat_flush+0x2b4/0x1b30 Code: 00 49 8d 7d 08 4d 89 6d 00 48 89 f8 48 c1 e8 03 42 80 3c 38 00 0f 85 29 0f 00 00 4d 8b 6d 08 49 8d 7d 20 48 89 f8 48 c1 e8 03 <42> 80 3c 38 00 0f 85 19 0f 00 00 48 8b 44 24 18 49 8b 6d 20 80 38 RSP: 0018:ffff888009547a80 EFLAGS: 00010012 RAX: 0000000000000004 RBX: ffff8880e55dd000 RCX: ffffffff824fcb97 RDX: ffff8880094f8000 RSI: ffffffff816cfaf9 RDI: 0000000000000023 RBP: ffffe8ffffc02a30 R08: 0000000000000001 R09: ffffed10012a8f42 R10: 0000000000000001 R11: 0000000000000001 R12: ffffe8ffffc02a38 R13: 0000000000000003 R14: ffffffff85c5b580 R15: dffffc0000000000 FS: 00007f1a7f69a900(0000) GS:ffff8880e55dd000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000055b9119c2408 CR3: 000000000bc30000 CR4: 0000000000350ef0 note: systemd[1] exited with irqs disabled note: systemd[1] exited with preempt_count 1 ---------------- Code disassembly (best guess): 0: 00 49 8d add %cl,-0x73(%rcx) 3: 7d 08 jge 0xd 5: 4d 89 6d 00 mov %r13,0x0(%r13) 9: 48 89 f8 mov %rdi,%rax c: 48 c1 e8 03 shr $0x3,%rax 10: 42 80 3c 38 00 cmpb $0x0,(%rax,%r15,1) 15: 0f 85 29 0f 00 00 jne 0xf44 1b: 4d 8b 6d 08 mov 0x8(%r13),%r13 1f: 49 8d 7d 20 lea 0x20(%r13),%rdi 23: 48 89 f8 mov %rdi,%rax 26: 48 c1 e8 03 shr $0x3,%rax * 2a: 42 80 3c 38 00 cmpb $0x0,(%rax,%r15,1) <-- trapping instruction 2f: 0f 85 19 0f 00 00 jne 0xf4e 35: 48 8b 44 24 18 mov 0x18(%rsp),%rax 3a: 49 8b 6d 20 mov 0x20(%r13),%rbp 3e: 80 .byte 0x80 3f: 38 .byte 0x38