Oops: general protection fault, probably for non-canonical address 0xdffffc0000000017: 0000 [#1] SMP KASAN NOPTI
KASAN: null-ptr-deref in range [0x00000000000000b8-0x00000000000000bf]
CPU: 1 UID: 0 PID: 12128 Comm: syz-executor.4 Not tainted 6.18.0-rc5-next-20251113 #1 PREEMPT(voluntary)
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
RIP: 0010:put_pid_ns+0x30/0x80
Code: 89 fd 53 e8 42 a0 03 00 48 85 ed 74 3d e8 38 a0 03 00 48 8d bd d0 00 00 00 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <80> 3c 02 00 75 35 48 8b 9d d0 00 00 00 bf 08 00 00 00 48 89 de e8
RSP: 0018:ffff888041befdb0 EFLAGS: 00010216
RAX: dffffc0000000000 RBX: 0000000000000001 RCX: ffffc90008979000
RDX: 0000000000000017 RSI: ffffffff81717278 RDI: 00000000000000ba
RBP: ffffffffffffffea R08: 0000000000000001 R09: 0000000000000001
R10: ffffffff8664e957 R11: ffff88806cf37498 R12: ffff88800c5ace38
R13: ffff88800c5acfec R14: ffffffff85cfdf20 R15: ffff888030af8878
FS: 00007f8e07a34700(0000) GS:ffff8880e5494000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00005555731f6c58 CR3: 000000003a62e000 CR4: 0000000000350ef0
Call Trace:
nsproxy_free+0xfa/0x5a0
create_new_namespaces+0x585/0x750
unshare_nsproxy_namespaces+0xc0/0x200
ksys_unshare+0x468/0xa10
__x64_sys_unshare+0x31/0x40
do_syscall_64+0xbf/0x430
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f8e0a4beb19
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f8e07a34188 EFLAGS: 00000246 ORIG_RAX: 0000000000000110
RAX: ffffffffffffffda RBX: 00007f8e0a5d1f60 RCX: 00007f8e0a4beb19
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 000000002c020600
RBP: 00007f8e0a518f6d R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007ffdc2a817bf R14: 00007f8e07a34300 R15: 0000000000022000
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:put_pid_ns+0x30/0x80
Code: 89 fd 53 e8 42 a0 03 00 48 85 ed 74 3d e8 38 a0 03 00 48 8d bd d0 00 00 00 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <80> 3c 02 00 75 35 48 8b 9d d0 00 00 00 bf 08 00 00 00 48 89 de e8
RSP: 0018:ffff888041befdb0 EFLAGS: 00010216
RAX: dffffc0000000000 RBX: 0000000000000001 RCX: ffffc90008979000
RDX: 0000000000000017 RSI: ffffffff81717278 RDI: 00000000000000ba
RBP: ffffffffffffffea R08: 0000000000000001 R09: 0000000000000001
R10: ffffffff8664e957 R11: ffff88806cf37498 R12: ffff88800c5ace38
R13: ffff88800c5acfec R14: ffffffff85cfdf20 R15: ffff888030af8878
FS: 00007f8e07a34700(0000) GS:ffff8880e5494000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00005555731f6c58 CR3: 000000003a62e000 CR4: 0000000000350ef0
tmpfs: Unknown parameter './file0/file0'
Oops: general protection fault, probably for non-canonical address 0xdffffc0000000017: 0000 [#2] SMP KASAN NOPTI
KASAN: null-ptr-deref in range [0x00000000000000b8-0x00000000000000bf]
CPU: 1 UID: 0 PID: 12161 Comm: syz-executor.4 Tainted: G D 6.18.0-rc5-next-20251113 #1 PREEMPT(voluntary)
Tainted: [D]=DIE
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
RIP: 0010:put_pid_ns+0x30/0x80
Code: 89 fd 53 e8 42 a0 03 00 48 85 ed 74 3d e8 38 a0 03 00 48 8d bd d0 00 00 00 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <80> 3c 02 00 75 35 48 8b 9d d0 00 00 00 bf 08 00 00 00 48 89 de e8
RSP: 0018:ffff888018d17db0 EFLAGS: 00010216
RAX: dffffc0000000000 RBX: 0000000000000001 RCX: ffffc90008979000
RDX: 0000000000000017 RSI: ffffffff81717278 RDI: 00000000000000ba
RBP: ffffffffffffffea R08: 0000000000000000 R09: 0000000000000000
R10: ffffffff8664e957 R11: 0000000000000000 R12: ffff88800c5ad6c0
R13: ffff88800c5ad874 R14: ffffffff85cfdf20 R15: ffff88801bc88878
FS: 00007f8e07a34700(0000) GS:ffff8880e5494000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b30622000 CR3: 000000001e9ad000 CR4: 0000000000350ef0
Call Trace:
nsproxy_free+0xfa/0x5a0
create_new_namespaces+0x585/0x750
unshare_nsproxy_namespaces+0xc0/0x200
ksys_unshare+0x468/0xa10
__x64_sys_unshare+0x31/0x40
do_syscall_64+0xbf/0x430
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f8e0a4beb19
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f8e07a34188 EFLAGS: 00000246 ORIG_RAX: 0000000000000110
RAX: ffffffffffffffda RBX: 00007f8e0a5d1f60 RCX: 00007f8e0a4beb19
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 000000002c020600
RBP: 00007f8e0a518f6d R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007ffdc2a817bf R14: 00007f8e07a34300 R15: 0000000000022000
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:put_pid_ns+0x30/0x80
Code: 89 fd 53 e8 42 a0 03 00 48 85 ed 74 3d e8 38 a0 03 00 48 8d bd d0 00 00 00 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <80> 3c 02 00 75 35 48 8b 9d d0 00 00 00 bf 08 00 00 00 48 89 de e8
RSP: 0018:ffff888041befdb0 EFLAGS: 00010216
RAX: dffffc0000000000 RBX: 0000000000000001 RCX: ffffc90008979000
RDX: 0000000000000017 RSI: ffffffff81717278 RDI: 00000000000000ba
RBP: ffffffffffffffea R08: 0000000000000001 R09: 0000000000000001
R10: ffffffff8664e957 R11: ffff88806cf37498 R12: ffff88800c5ace38
R13: ffff88800c5acfec R14: ffffffff85cfdf20 R15: ffff888030af8878
FS: 00007f8e07a34700(0000) GS:ffff8880e5494000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b30622000 CR3: 000000001e9ad000 CR4: 0000000000350ef0
Oops: general protection fault, probably for non-canonical address 0xdffffc0000000017: 0000 [#3] SMP KASAN NOPTI
KASAN: null-ptr-deref in range [0x00000000000000b8-0x00000000000000bf]
CPU: 1 UID: 0 PID: 12176 Comm: syz-executor.2 Tainted: G D 6.18.0-rc5-next-20251113 #1 PREEMPT(voluntary)
Tainted: [D]=DIE
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
RIP: 0010:put_pid_ns+0x30/0x80
Code: 89 fd 53 e8 42 a0 03 00 48 85 ed 74 3d e8 38 a0 03 00 48 8d bd d0 00 00 00 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <80> 3c 02 00 75 35 48 8b 9d d0 00 00 00 bf 08 00 00 00 48 89 de e8
RSP: 0018:ffff88801719fdb0 EFLAGS: 00010216
RAX: dffffc0000000000 RBX: 0000000000000001 RCX: ffffc90008376000
RDX: 0000000000000017 RSI: ffffffff81717278 RDI: 00000000000000ba
RBP: ffffffffffffffea R08: 0000000000000000 R09: 0000000000000000
R10: ffffffff8664e957 R11: ffff88806cf37498 R12: ffff88800c5adc70
R13: ffff88800c5ade24 R14: ffffffff85cfdf20 R15: ffff888015d32438
FS: 00007f7e461d1700(0000) GS:ffff8880e5494000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b2ce2e000 CR3: 0000000013d53000 CR4: 0000000000350ef0
Call Trace:
nsproxy_free+0xfa/0x5a0
create_new_namespaces+0x585/0x750
unshare_nsproxy_namespaces+0xc0/0x200
ksys_unshare+0x468/0xa10
__x64_sys_unshare+0x31/0x40
do_syscall_64+0xbf/0x430
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f7e48c5bb19
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f7e461d1188 EFLAGS: 00000246 ORIG_RAX: 0000000000000110
RAX: ffffffffffffffda RBX: 00007f7e48d6ef60 RCX: 00007f7e48c5bb19
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 000000002c020600
RBP: 00007f7e48cb5f6d R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007ffd73a0073f R14: 00007f7e461d1300 R15: 0000000000022000
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:put_pid_ns+0x30/0x80
Code: 89 fd 53 e8 42 a0 03 00 48 85 ed 74 3d e8 38 a0 03 00 48 8d bd d0 00 00 00 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <80> 3c 02 00 75 35 48 8b 9d d0 00 00 00 bf 08 00 00 00 48 89 de e8
RSP: 0018:ffff888041befdb0 EFLAGS: 00010216
RAX: dffffc0000000000 RBX: 0000000000000001 RCX: ffffc90008979000
RDX: 0000000000000017 RSI: ffffffff81717278 RDI: 00000000000000ba
RBP: ffffffffffffffea R08: 0000000000000001 R09: 0000000000000001
R10: ffffffff8664e957 R11: ffff88806cf37498 R12: ffff88800c5ace38
R13: ffff88800c5acfec R14: ffffffff85cfdf20 R15: ffff888030af8878
FS: 00007f7e461d1700(0000) GS:ffff8880e5494000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b2ce2e000 CR3: 0000000013d53000 CR4: 0000000000350ef0
Oops: general protection fault, probably for non-canonical address 0xdffffc0000000017: 0000 [#4] SMP KASAN NOPTI
KASAN: null-ptr-deref in range [0x00000000000000b8-0x00000000000000bf]
CPU: 1 UID: 0 PID: 12188 Comm: syz-executor.2 Tainted: G D 6.18.0-rc5-next-20251113 #1 PREEMPT(voluntary)
Tainted: [D]=DIE
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
RIP: 0010:put_pid_ns+0x30/0x80
Code: 89 fd 53 e8 42 a0 03 00 48 85 ed 74 3d e8 38 a0 03 00 48 8d bd d0 00 00 00 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <80> 3c 02 00 75 35 48 8b 9d d0 00 00 00 bf 08 00 00 00 48 89 de e8
RSP: 0018:ffff888018f77db0 EFLAGS: 00010216
RAX: dffffc0000000000 RBX: 0000000000000001 RCX: ffffc90008376000
RDX: 0000000000000017 RSI: ffffffff81717278 RDI: 00000000000000ba
RBP: ffffffffffffffea R08: 0000000000000000 R09: 0000000000000000
R10: ffffffff8664e957 R11: 0000000000000000 R12: ffff88800c5ae220
R13: ffff88800c5ae3d4 R14: ffffffff85cfdf20 R15: ffff8880445adbb8
FS: 00007f7e461d1700(0000) GS:ffff8880e5494000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b3162e000 CR3: 000000004589f000 CR4: 0000000000350ef0
Call Trace:
nsproxy_free+0xfa/0x5a0
create_new_namespaces+0x585/0x750
unshare_nsproxy_namespaces+0xc0/0x200
ksys_unshare+0x468/0xa10
__x64_sys_unshare+0x31/0x40
do_syscall_64+0xbf/0x430
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f7e48c5bb19
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f7e461d1188 EFLAGS: 00000246 ORIG_RAX: 0000000000000110
RAX: ffffffffffffffda RBX: 00007f7e48d6ef60 RCX: 00007f7e48c5bb19
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 000000002c020600
RBP: 00007f7e48cb5f6d R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007ffd73a0073f R14: 00007f7e461d1300 R15: 0000000000022000
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:put_pid_ns+0x30/0x80
Code: 89 fd 53 e8 42 a0 03 00 48 85 ed 74 3d e8 38 a0 03 00 48 8d bd d0 00 00 00 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <80> 3c 02 00 75 35 48 8b 9d d0 00 00 00 bf 08 00 00 00 48 89 de e8
RSP: 0018:ffff888041befdb0 EFLAGS: 00010216
RAX: dffffc0000000000 RBX: 0000000000000001 RCX: ffffc90008979000
RDX: 0000000000000017 RSI: ffffffff81717278 RDI: 00000000000000ba
RBP: ffffffffffffffea R08: 0000000000000001 R09: 0000000000000001
R10: ffffffff8664e957 R11: ffff88806cf37498 R12: ffff88800c5ace38
R13: ffff88800c5acfec R14: ffffffff85cfdf20 R15: ffff888030af8878
FS: 00007f7e461d1700(0000) GS:ffff8880e5494000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b3162e000 CR3: 000000004589f000 CR4: 0000000000350ef0
Oops: general protection fault, probably for non-canonical address 0xdffffc0000000017: 0000 [#5] SMP KASAN NOPTI
KASAN: null-ptr-deref in range [0x00000000000000b8-0x00000000000000bf]
CPU: 0 UID: 0 PID: 12191 Comm: syz-executor.4 Tainted: G D 6.18.0-rc5-next-20251113 #1 PREEMPT(voluntary)
Tainted: [D]=DIE
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
RIP: 0010:put_pid_ns+0x30/0x80
Code: 89 fd 53 e8 42 a0 03 00 48 85 ed 74 3d e8 38 a0 03 00 48 8d bd d0 00 00 00 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <80> 3c 02 00 75 35 48 8b 9d d0 00 00 00 bf 08 00 00 00 48 89 de e8
RSP: 0018:ffff88801e1bfdb0 EFLAGS: 00010216
RAX: dffffc0000000000 RBX: 0000000000000001 RCX: ffffc90008979000
RDX: 0000000000000017 RSI: ffffffff81717278 RDI: 00000000000000ba
RBP: ffffffffffffffea R08: 0000000000000000 R09: 0000000000000000
R10: ffffffff8664e957 R11: 0000000000000000 R12: ffff88800cea6aa8
R13: ffff88800cea6c5c R14: ffffffff85cfdf20 R15: ffff88800ca58878
FS: 00007f8e07a34700(0000) GS:ffff8880e5394000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b3032a000 CR3: 0000000013d53000 CR4: 0000000000350ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600
Call Trace:
nsproxy_free+0xfa/0x5a0
create_new_namespaces+0x585/0x750
unshare_nsproxy_namespaces+0xc0/0x200
ksys_unshare+0x468/0xa10
__x64_sys_unshare+0x31/0x40
do_syscall_64+0xbf/0x430
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f8e0a4beb19
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f8e07a34188 EFLAGS: 00000246 ORIG_RAX: 0000000000000110
RAX: ffffffffffffffda RBX: 00007f8e0a5d1f60 RCX: 00007f8e0a4beb19
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 000000002c020600
RBP: 00007f8e0a518f6d R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007ffdc2a817bf R14: 00007f8e07a34300 R15: 0000000000022000
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:put_pid_ns+0x30/0x80
Code: 89 fd 53 e8 42 a0 03 00 48 85 ed 74 3d e8 38 a0 03 00 48 8d bd d0 00 00 00 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <80> 3c 02 00 75 35 48 8b 9d d0 00 00 00 bf 08 00 00 00 48 89 de e8
RSP: 0018:ffff888041befdb0 EFLAGS: 00010216
RAX: dffffc0000000000 RBX: 0000000000000001 RCX: ffffc90008979000
RDX: 0000000000000017 RSI: ffffffff81717278 RDI: 00000000000000ba
RBP: ffffffffffffffea R08: 0000000000000001 R09: 0000000000000001
R10: ffffffff8664e957 R11: ffff88806cf37498 R12: ffff88800c5ace38
R13: ffff88800c5acfec R14: ffffffff85cfdf20 R15: ffff888030af8878
FS: 00007f8e07a34700(0000) GS:ffff8880e5394000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b3032a000 CR3: 0000000013d53000 CR4: 0000000000350ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600
Bluetooth: hci5: unexpected subevent 0x01 length: 30 > 18
Bluetooth: hci5: unexpected subevent 0x01 length: 30 > 18
debugfs: '0' already exists in 'hci5'
sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci5/hci5:0'
CPU: 1 UID: 0 PID: 866 Comm: kworker/u11:4 Tainted: G D 6.18.0-rc5-next-20251113 #1 PREEMPT(voluntary)
Tainted: [D]=DIE
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
Workqueue: hci5 hci_rx_work
Call Trace:
dump_stack_lvl+0xfa/0x120
sysfs_warn_dup+0x80/0xa0
sysfs_create_dir_ns+0x23b/0x2a0
kobject_add_internal+0x24c/0x9a0
kobject_add+0x157/0x240
device_add+0x32d/0x1830
hci_conn_add_sysfs+0x117/0x1c0
le_conn_complete_evt+0x124b/0x1f60
hci_le_conn_complete_evt+0x22a/0x2c0
hci_le_meta_evt+0x34b/0x530
hci_event_packet+0x66c/0x10e0
hci_rx_work+0x96c/0x1270
process_one_work+0x8e1/0x19c0
worker_thread+0x67e/0xe90
kthread+0x3c8/0x740
ret_from_fork+0x67a/0x7a0
ret_from_fork_asm+0x1a/0x30
kobject: kobject_add_internal failed for hci5:0 with -EEXIST, don't try to register things with the same name in the same directory.
Bluetooth: hci5: failed to register connection device
Bluetooth: hci5: unexpected subevent 0x01 length: 30 > 18
debugfs: '0' already exists in 'hci5'
sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci5/hci5:0'
CPU: 0 UID: 0 PID: 11668 Comm: kworker/u11:0 Tainted: G D 6.18.0-rc5-next-20251113 #1 PREEMPT(voluntary)
Tainted: [D]=DIE
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
Workqueue: hci5 hci_rx_work
Call Trace:
dump_stack_lvl+0xfa/0x120
sysfs_warn_dup+0x80/0xa0
sysfs_create_dir_ns+0x23b/0x2a0
kobject_add_internal+0x24c/0x9a0
kobject_add+0x157/0x240
device_add+0x32d/0x1830
hci_conn_add_sysfs+0x117/0x1c0
le_conn_complete_evt+0x124b/0x1f60
hci_le_conn_complete_evt+0x22a/0x2c0
hci_le_meta_evt+0x34b/0x530
hci_event_packet+0x66c/0x10e0
hci_rx_work+0x96c/0x1270
process_one_work+0x8e1/0x19c0
worker_thread+0x67e/0xe90
kthread+0x3c8/0x740
ret_from_fork+0x67a/0x7a0
ret_from_fork_asm+0x1a/0x30
kobject: kobject_add_internal failed for hci5:0 with -EEXIST, don't try to register things with the same name in the same directory.
Bluetooth: hci5: failed to register connection device
Oops: general protection fault, probably for non-canonical address 0xdffffc0000000017: 0000 [#6] SMP KASAN NOPTI
KASAN: null-ptr-deref in range [0x00000000000000b8-0x00000000000000bf]
CPU: 0 UID: 0 PID: 12228 Comm: syz-executor.4 Tainted: G D 6.18.0-rc5-next-20251113 #1 PREEMPT(voluntary)
Tainted: [D]=DIE
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
RIP: 0010:put_pid_ns+0x30/0x80
Code: 89 fd 53 e8 42 a0 03 00 48 85 ed 74 3d e8 38 a0 03 00 48 8d bd d0 00 00 00 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <80> 3c 02 00 75 35 48 8b 9d d0 00 00 00 bf 08 00 00 00 48 89 de e8
RSP: 0018:ffff888041bf7db0 EFLAGS: 00010216
RAX: dffffc0000000000 RBX: 0000000000000001 RCX: ffffc90008979000
RDX: 0000000000000017 RSI: ffffffff81717278 RDI: 00000000000000ba
RBP: ffffffffffffffea R08: 0000000000000000 R09: 0000000000000000
R10: ffffffff8664e957 R11: 0000000000000000 R12: ffff88800cea7058
R13: ffff88800cea720c R14: ffffffff85cfdf20 R15: ffff888015e1dbb8
FS: 00007f8e07a34700(0000) GS:ffff8880e5394000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f6cf6619540 CR3: 0000000046e70000 CR4: 0000000000350ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600
Call Trace:
nsproxy_free+0xfa/0x5a0
create_new_namespaces+0x585/0x750
unshare_nsproxy_namespaces+0xc0/0x200
ksys_unshare+0x468/0xa10
__x64_sys_unshare+0x31/0x40
do_syscall_64+0xbf/0x430
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f8e0a4beb19
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f8e07a34188 EFLAGS: 00000246 ORIG_RAX: 0000000000000110
RAX: ffffffffffffffda RBX: 00007f8e0a5d1f60 RCX: 00007f8e0a4beb19
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 000000002c020600
RBP: 00007f8e0a518f6d R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007ffdc2a817bf R14: 00007f8e07a34300 R15: 0000000000022000
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:put_pid_ns+0x30/0x80
Code: 89 fd 53 e8 42 a0 03 00 48 85 ed 74 3d e8 38 a0 03 00 48 8d bd d0 00 00 00 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <80> 3c 02 00 75 35 48 8b 9d d0 00 00 00 bf 08 00 00 00 48 89 de e8
RSP: 0018:ffff888041befdb0 EFLAGS: 00010216
RAX: dffffc0000000000 RBX: 0000000000000001 RCX: ffffc90008979000
RDX: 0000000000000017 RSI: ffffffff81717278 RDI: 00000000000000ba
RBP: ffffffffffffffea R08: 0000000000000001 R09: 0000000000000001
R10: ffffffff8664e957 R11: ffff88806cf37498 R12: ffff88800c5ace38
R13: ffff88800c5acfec R14: ffffffff85cfdf20 R15: ffff888030af8878
FS: 00007f8e07a34700(0000) GS:ffff8880e5394000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f6cf6619540 CR3: 0000000046e70000 CR4: 0000000000350ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600
Bluetooth: hci5: unexpected subevent 0x01 length: 30 > 18
debugfs: '0' already exists in 'hci5'
sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci5/hci5:0'
CPU: 1 UID: 0 PID: 866 Comm: kworker/u11:4 Tainted: G D 6.18.0-rc5-next-20251113 #1 PREEMPT(voluntary)
Tainted: [D]=DIE
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
Workqueue: hci5 hci_rx_work
Call Trace:
dump_stack_lvl+0xfa/0x120
sysfs_warn_dup+0x80/0xa0
sysfs_create_dir_ns+0x23b/0x2a0
kobject_add_internal+0x24c/0x9a0
kobject_add+0x157/0x240
device_add+0x32d/0x1830
hci_conn_add_sysfs+0x117/0x1c0
le_conn_complete_evt+0x124b/0x1f60
hci_le_conn_complete_evt+0x22a/0x2c0
hci_le_meta_evt+0x34b/0x530
hci_event_packet+0x66c/0x10e0
hci_rx_work+0x96c/0x1270
process_one_work+0x8e1/0x19c0
worker_thread+0x67e/0xe90
kthread+0x3c8/0x740
ret_from_fork+0x67a/0x7a0
ret_from_fork_asm+0x1a/0x30
loop3: detected capacity change from 0 to 16
kobject: kobject_add_internal failed for hci5:0 with -EEXIST, don't try to register things with the same name in the same directory.
EXT4-fs (loop3): fragment/cluster size (65536) != block size (4096)
Bluetooth: hci5: failed to register connection device
loop3: detected capacity change from 0 to 16
Bluetooth: hci5: unexpected subevent 0x01 length: 30 > 18
debugfs: '0' already exists in 'hci5'
sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci5/hci5:0'
CPU: 0 UID: 0 PID: 11668 Comm: kworker/u11:0 Tainted: G D 6.18.0-rc5-next-20251113 #1 PREEMPT(voluntary)
Tainted: [D]=DIE
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
Workqueue: hci5 hci_rx_work
Call Trace:
dump_stack_lvl+0xfa/0x120
sysfs_warn_dup+0x80/0xa0
sysfs_create_dir_ns+0x23b/0x2a0
kobject_add_internal+0x24c/0x9a0
kobject_add+0x157/0x240
device_add+0x32d/0x1830
hci_conn_add_sysfs+0x117/0x1c0
le_conn_complete_evt+0x124b/0x1f60
hci_le_conn_complete_evt+0x22a/0x2c0
hci_le_meta_evt+0x34b/0x530
hci_event_packet+0x66c/0x10e0
hci_rx_work+0x96c/0x1270
process_one_work+0x8e1/0x19c0
worker_thread+0x67e/0xe90
kthread+0x3c8/0x740
ret_from_fork+0x67a/0x7a0
ret_from_fork_asm+0x1a/0x30
Oops: general protection fault, probably for non-canonical address 0xdffffc0000000017: 0000 [#7] SMP KASAN NOPTI
kobject: kobject_add_internal failed for hci5:0 with -EEXIST, don't try to register things with the same name in the same directory.
KASAN: null-ptr-deref in range [0x00000000000000b8-0x00000000000000bf]
Bluetooth: hci5: failed to register connection device
CPU: 1 UID: 0 PID: 12242 Comm: syz-executor.2 Tainted: G D 6.18.0-rc5-next-20251113 #1 PREEMPT(voluntary)
Tainted: [D]=DIE
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
RIP: 0010:put_pid_ns+0x30/0x80
Code: 89 fd 53 e8 42 a0 03 00 48 85 ed 74 3d e8 38 a0 03 00 48 8d bd d0 00 00 00 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <80> 3c 02 00 75 35 48 8b 9d d0 00 00 00 bf 08 00 00 00 48 89 de e8
RSP: 0018:ffff88803d51fdb0 EFLAGS: 00010216
RAX: dffffc0000000000 RBX: 0000000000000001 RCX: ffffc90008376000
RDX: 0000000000000017 RSI: ffffffff81717278 RDI: 00000000000000ba
RBP: ffffffffffffffea R08: 0000000000000000 R09: 0000000000000000
R10: ffffffff8664e957 R11: 0000000000000000 R12: ffff88800c5ae7d0
R13: ffff88800c5ae984 R14: ffffffff85cfdf20 R15: ffff888040b35bb8
FS: 00007f7e461d1700(0000) GS:ffff8880e5494000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b30922000 CR3: 000000000cec9000 CR4: 0000000000350ef0
Call Trace:
nsproxy_free+0xfa/0x5a0
create_new_namespaces+0x585/0x750
unshare_nsproxy_namespaces+0xc0/0x200
ksys_unshare+0x468/0xa10
__x64_sys_unshare+0x31/0x40
do_syscall_64+0xbf/0x430
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f7e48c5bb19
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f7e461d1188 EFLAGS: 00000246 ORIG_RAX: 0000000000000110
RAX: ffffffffffffffda RBX: 00007f7e48d6ef60 RCX: 00007f7e48c5bb19
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 000000002c020600
RBP: 00007f7e48cb5f6d R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007ffd73a0073f R14: 00007f7e461d1300 R15: 0000000000022000
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:put_pid_ns+0x30/0x80
Code: 89 fd 53 e8 42 a0 03 00 48 85 ed 74 3d e8 38 a0 03 00 48 8d bd d0 00 00 00 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <80> 3c 02 00 75 35 48 8b 9d d0 00 00 00 bf 08 00 00 00 48 89 de e8
RSP: 0018:ffff888041befdb0 EFLAGS: 00010216
RAX: dffffc0000000000 RBX: 0000000000000001 RCX: ffffc90008979000
RDX: 0000000000000017 RSI: ffffffff81717278 RDI: 00000000000000ba
RBP: ffffffffffffffea R08: 0000000000000001 R09: 0000000000000001
R10: ffffffff8664e957 R11: ffff88806cf37498 R12: ffff88800c5ace38
R13: ffff88800c5acfec R14: ffffffff85cfdf20 R15: ffff888030af8878
FS: 00007f7e461d1700(0000) GS:ffff8880e5494000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b30922000 CR3: 000000000cec9000 CR4: 0000000000350ef0
EXT4-fs (loop3): fragment/cluster size (65536) != block size (4096)
loop3: detected capacity change from 0 to 16
EXT4-fs (loop3): fragment/cluster size (65536) != block size (4096)
sr 1:0:0:0: [sr0] tag#0 unaligned transfer
I/O error, dev sr0, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2
loop3: detected capacity change from 0 to 16
sr 1:0:0:0: [sr0] tag#0 unaligned transfer
I/O error, dev sr0, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2
EXT4-fs (loop3): fragment/cluster size (65536) != block size (4096)
Bluetooth: hci5: command 0x0406 tx timeout
kauditd_printk_skb: 3 callbacks suppressed
audit: type=1400 audit(2000000041.360:35): avc: denied { relabelfrom } for pid=12279 comm="syz-executor.7" name="" dev="pipefs" ino=22502 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=fifo_file permissive=1
sr 1:0:0:0: [sr0] tag#0 unaligned transfer
I/O error, dev sr0, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2
sr 1:0:0:0: [sr0] tag#0 unaligned transfer
I/O error, dev sr0, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2
loop3: detected capacity change from 0 to 16
EXT4-fs (loop3): fragment/cluster size (65536) != block size (4096)
sr 1:0:0:0: [sr0] tag#0 unaligned transfer
I/O error, dev sr0, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2
sr 1:0:0:0: [sr0] tag#0 unaligned transfer
I/O error, dev sr0, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2
sr 1:0:0:0: [sr0] tag#0 unaligned transfer
I/O error, dev sr0, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2
audit: type=1400 audit(2000000043.297:36): avc: denied { watch_reads } for pid=12459 comm="syz-executor.1" path="/syzkaller-testdir389502614/syzkaller.JHyaBc/248/file0" dev="sda" ino=16071 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:unlabeled_t:s0 tclass=file permissive=1
netlink: 12 bytes leftover after parsing attributes in process `syz-executor.5'.
mac80211_hwsim hwsim9 wlan1: entered allmulticast mode
mac80211_hwsim hwsim9 wlan1: left allmulticast mode
netlink: 12 bytes leftover after parsing attributes in process `syz-executor.5'.
Bluetooth: hci5: command 0x0406 tx timeout
mac80211_hwsim hwsim9 wlan1: entered allmulticast mode
mac80211_hwsim hwsim9 wlan1: left allmulticast mode
netlink: 12 bytes leftover after parsing attributes in process `syz-executor.5'.
mac80211_hwsim hwsim7 wlan1: entered allmulticast mode
mac80211_hwsim hwsim7 wlan1: left allmulticast mode
netlink: 12 bytes leftover after parsing attributes in process `syz-executor.5'.
mac80211_hwsim hwsim9 wlan1: entered allmulticast mode
mac80211_hwsim hwsim9 wlan1: left allmulticast mode
mac80211_hwsim hwsim7 wlan1: entered allmulticast mode
mac80211_hwsim hwsim7 wlan1: left allmulticast mode
netlink: 12 bytes leftover after parsing attributes in process `syz-executor.5'.
mac80211_hwsim hwsim9 wlan1: entered allmulticast mode
mac80211_hwsim hwsim9 wlan1: left allmulticast mode
mac80211_hwsim hwsim7 wlan1: entered allmulticast mode
mac80211_hwsim hwsim7 wlan1: left allmulticast mode
audit: type=1326 audit(2000000043.975:37): auid=0 uid=0 gid=0 ses=4 subj=system_u:system_r:kernel_t:s0 pid=12554 comm="syz-executor.6" exe="/syz-executor.6" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fe05a71fb19 code=0x0
audit: type=1326 audit(2000000044.140:38): auid=0 uid=0 gid=0 ses=4 subj=system_u:system_r:kernel_t:s0 pid=12588 comm="syz-executor.6" exe="/syz-executor.6" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fe05a71fb19 code=0x0
audit: type=1326 audit(2000000044.255:39): auid=0 uid=0 gid=0 ses=4 subj=system_u:system_r:kernel_t:s0 pid=12609 comm="syz-executor.6" exe="/syz-executor.6" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fe05a71fb19 code=0x0
audit: type=1326 audit(2000000044.400:40): auid=0 uid=0 gid=0 ses=4 subj=system_u:system_r:kernel_t:s0 pid=12627 comm="syz-executor.6" exe="/syz-executor.6" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fe05a71fb19 code=0x0
loop3: detected capacity change from 0 to 128
loop3: detected capacity change from 0 to 128
loop3: detected capacity change from 0 to 128
loop3: detected capacity change from 0 to 128
audit: type=1326 audit(2000000044.932:41): auid=0 uid=0 gid=0 ses=4 subj=system_u:system_r:kernel_t:s0 pid=12705 comm="syz-executor.4" exe="/syz-executor.4" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8e0a4beb19 code=0x7ffc0000
audit: type=1326 audit(2000000044.932:42): auid=0 uid=0 gid=0 ses=4 subj=system_u:system_r:kernel_t:s0 pid=12705 comm="syz-executor.4" exe="/syz-executor.4" sig=0 arch=c000003e syscall=298 compat=0 ip=0x7f8e0a4beb19 code=0x7ffc0000
audit: type=1326 audit(2000000044.937:43): auid=0 uid=0 gid=0 ses=4 subj=system_u:system_r:kernel_t:s0 pid=12705 comm="syz-executor.4" exe="/syz-executor.4" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8e0a4beb19 code=0x7ffc0000
audit: type=1326 audit(2000000044.937:44): auid=0 uid=0 gid=0 ses=4 subj=system_u:system_r:kernel_t:s0 pid=12705 comm="syz-executor.4" exe="/syz-executor.4" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8e0a4beb19 code=0x7ffc0000
No source specified
No source specified
No source specified
No source specified
Bluetooth: hci5: command 0x0406 tx timeout
No source specified
loop6: detected capacity change from 0 to 512
netlink: 16 bytes leftover after parsing attributes in process `syz-executor.2'.
netlink: 16 bytes leftover after parsing attributes in process `syz-executor.2'.
EXT4-fs (loop6): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
ext4 filesystem being mounted at /syzkaller-testdir842647342/syzkaller.Yyp3HO/264/file0 supports timestamps until 2038-01-19 (0x7fffffff)
EXT4-fs (loop6): unmounting filesystem 00000000-0000-0000-0000-000000000000.
loop6: detected capacity change from 0 to 512
netlink: 16 bytes leftover after parsing attributes in process `syz-executor.2'.
EXT4-fs (loop6): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
netlink: 16 bytes leftover after parsing attributes in process `syz-executor.2'.
ext4 filesystem being mounted at /syzkaller-testdir842647342/syzkaller.Yyp3HO/265/file0 supports timestamps until 2038-01-19 (0x7fffffff)
EXT4-fs (loop6): unmounting filesystem 00000000-0000-0000-0000-000000000000.
netlink: 16 bytes leftover after parsing attributes in process `syz-executor.2'.
loop6: detected capacity change from 0 to 512
EXT4-fs (loop6): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
ext4 filesystem being mounted at /syzkaller-testdir842647342/syzkaller.Yyp3HO/266/file0 supports timestamps until 2038-01-19 (0x7fffffff)
EXT4-fs (loop6): unmounting filesystem 00000000-0000-0000-0000-000000000000.
tmpfs: Unknown parameter './file0/file0'
loop6: detected capacity change from 0 to 512
EXT4-fs (loop6): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
ext4 filesystem being mounted at /syzkaller-testdir842647342/syzkaller.Yyp3HO/267/file0 supports timestamps until 2038-01-19 (0x7fffffff)
EXT4-fs (loop6): unmounting filesystem 00000000-0000-0000-0000-000000000000.
loop6: detected capacity change from 0 to 16380
loop6: detected capacity change from 0 to 16380
loop6: detected capacity change from 0 to 16380
loop6: detected capacity change from 0 to 16380
----------------
Code disassembly (best guess):
0: 89 fd mov %edi,%ebp
2: 53 push %rbx
3: e8 42 a0 03 00 callq 0x3a04a
8: 48 85 ed test %rbp,%rbp
b: 74 3d je 0x4a
d: e8 38 a0 03 00 callq 0x3a04a
12: 48 8d bd d0 00 00 00 lea 0xd0(%rbp),%rdi
19: 48 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%rax
20: fc ff df
23: 48 89 fa mov %rdi,%rdx
26: 48 c1 ea 03 shr $0x3,%rdx
* 2a: 80 3c 02 00 cmpb $0x0,(%rdx,%rax,1) <-- trapping instruction
2e: 75 35 jne 0x65
30: 48 8b 9d d0 00 00 00 mov 0xd0(%rbp),%rbx
37: bf 08 00 00 00 mov $0x8,%edi
3c: 48 89 de mov %rbx,%rsi
3f: e8 .byte 0xe8