Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1
Oops: general protection fault, probably for non-canonical address 0xe01ffbf11002c457: 0000 [#1] SMP KASAN NOPTI
KASAN: maybe wild-memory-access in range [0x00ffff88801622b8-0x00ffff88801622bf]
CPU: 0 UID: 0 PID: 8972 Comm: syz-executor.0 Tainted: G W 6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary)
Tainted: [W]=WARN
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
RIP: 0010:kasan_byte_accessible+0x15/0x30
Code: 00 00 0f 1f 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 66 0f 1f 00 48 b8 00 00 00 00 00 fc ff df 48 c1 ef 03 48 01 c7 <0f> b6 07 3c 07 0f 96 c0 e9 7e 15 0e 03 66 66 2e 0f 1f 84 00 00 00
RSP: 0018:ffff888016b079e8 EFLAGS: 00010082
RAX: dffffc0000000000 RBX: 0000000000000001 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffffffff84bddf4b RDI: e01ffbf11002c457
RBP: 00ffff88801622b8 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000020000 R11: 0000000000000001 R12: 0000000000000000
R13: ffffffff84bddf4b R14: 0000000000000000 R15: ffff88801bcab000
FS: 00007f5524fb1700(0000) GS:ffff8880e55dd000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055dce564e438 CR3: 0000000046229000 CR4: 0000000000350ef0
Call Trace:
__kasan_check_byte+0x14/0x50
lock_acquire+0xec/0x2f0
_raw_spin_lock+0x2b/0x40
__queue_work+0x27d/0x1240
queue_work_on+0xd0/0xe0
hci_recv_frame+0x501/0x890
vhci_write+0x37b/0x480
do_iter_readv_writev+0x5af/0x910
vfs_writev+0x2d4/0xcd0
do_writev+0x129/0x330
do_syscall_64+0xbf/0x360
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f552723a94d
Code: 28 89 54 24 1c 48 89 74 24 10 89 7c 24 08 e8 3a 37 02 00 8b 54 24 1c 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 14 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 33 44 89 c7 48 89 44 24 08 e8 6e 37 02 00 48
RSP: 002b:00007f5524fb0c80 EFLAGS: 00000293 ORIG_RAX: 0000000000000014
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f552723a94d
RDX: 0000000000000004 RSI: 00007f5524fb0cc0 RDI: 00000000000000f1
RBP: 00007f5524fb0e20 R08: 0000000000000000 R09: 00007f5524fb1700
R10: 00007f5524fb19d0 R11: 0000000000000293 R12: 00007f5524fb0e10
R13: 000600046003fd00 R14: 00007f5524fb1300 R15: 0000000000802000
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:kasan_byte_accessible+0x15/0x30
Code: 00 00 0f 1f 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 66 0f 1f 00 48 b8 00 00 00 00 00 fc ff df 48 c1 ef 03 48 01 c7 <0f> b6 07 3c 07 0f 96 c0 e9 7e 15 0e 03 66 66 2e 0f 1f 84 00 00 00
RSP: 0018:ffff888016b079e8 EFLAGS: 00010082
RAX: dffffc0000000000 RBX: 0000000000000001 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffffffff84bddf4b RDI: e01ffbf11002c457
RBP: 00ffff88801622b8 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000020000 R11: 0000000000000001 R12: 0000000000000000
R13: ffffffff84bddf4b R14: 0000000000000000 R15: ffff88801bcab000
FS: 00007f5524fb1700(0000) GS:ffff8880e55dd000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055dce564e438 CR3: 0000000046229000 CR4: 0000000000350ef0
note: syz-executor.0[8972] exited with irqs disabled
note: syz-executor.0[8972] exited with preempt_count 1
BUG: sleeping function called from invalid context at ./include/linux/percpu-rwsem.h:51
in_atomic(): 0, irqs_disabled(): 0, non_block: 0, pid: 8972, name: syz-executor.0
preempt_count: 0, expected: 0
RCU nest depth: 1, expected: 0
INFO: lockdep is turned off.
CPU: 0 UID: 0 PID: 8972 Comm: syz-executor.0 Tainted: G D W 6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary)
Tainted: [D]=DIE, [W]=WARN
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
Call Trace:
dump_stack_lvl+0xfa/0x120
__might_resched+0x2f3/0x510
exit_signals+0x25/0x940
do_exit+0x2db/0x2970
make_task_dead+0x174/0x3b0
rewind_stack_and_make_dead+0x16/0x20
RIP: 0033:0x7f552723a94d
Code: 28 89 54 24 1c 48 89 74 24 10 89 7c 24 08 e8 3a 37 02 00 8b 54 24 1c 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 14 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 33 44 89 c7 48 89 44 24 08 e8 6e 37 02 00 48
RSP: 002b:00007f5524fb0c80 EFLAGS: 00000293 ORIG_RAX: 0000000000000014
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f552723a94d
RDX: 0000000000000004 RSI: 00007f5524fb0cc0 RDI: 00000000000000f1
RBP: 00007f5524fb0e20 R08: 0000000000000000 R09: 00007f5524fb1700
R10: 00007f5524fb19d0 R11: 0000000000000293 R12: 00007f5524fb0e10
R13: 000600046003fd00 R14: 00007f5524fb1300 R15: 0000000000802000
Bluetooth: hci2: Opcode 0x1003 failed: -110
Bluetooth: hci2: command 0x1003 tx timeout
Bluetooth: hci2: Opcode 0x0c03 failed: -110
------------[ cut here ]------------
percpu ref (css_release) <= 0 (-262782784310786) after switching to atomic
WARNING: lib/percpu-refcount.c:197 at percpu_ref_switch_to_atomic_rcu+0x3cc/0x480, CPU#0: swapper/0/0
Modules linked in:
CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Tainted: G D W 6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary)
Tainted: [D]=DIE, [W]=WARN
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
RIP: 0010:percpu_ref_switch_to_atomic_rcu+0x3cc/0x480
Code: 00 00 00 00 00 fc ff df 48 89 f9 48 c1 e9 03 80 3c 01 00 0f 85 9e 00 00 00 49 8b 75 e8 48 c7 c7 80 97 e2 84 e8 75 c5 e9 fe 90 <0f> 0b 90 90 e9 2b ff ff ff e8 f6 de 5f ff e9 9e fe ff ff e8 7c df
RSP: 0018:ffff88806ce08e20 EFLAGS: 00010286
RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffffff8139de70
RDX: ffffffff85a2c8c0 RSI: ffffffff8139de7e RDI: 0000000000000001
RBP: 7fff11001d7cf1fe R08: 0000000000000001 R09: ffffed100d9c4801
R10: 0000000000000000 R11: 0000000000000001 R12: ffff888044680580
R13: ffff8880446805a0 R14: 0000000000000002 R15: 0000000000000003
FS: 0000000000000000(0000) GS:ffff8880e55dd000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fff7a8d2000 CR3: 000000000f66f000 CR4: 0000000000350ef0
Call Trace:
rcu_core+0x7c8/0x1800
handle_softirqs+0x1b1/0x770
__irq_exit_rcu+0xc4/0x100
irq_exit_rcu+0x9/0x20
sysvec_apic_timer_interrupt+0x70/0x80
asm_sysvec_apic_timer_interrupt+0x1a/0x20
RIP: 0010:pv_native_safe_halt+0x1e/0x30
Code: 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 0f 1f 44 00 00 eb 0c 0f 1f 44 00 00 0f 00 2d 69 f7 09 00 0f 1f 44 00 00 fb f4 dd 83 02 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 90 90 90 90
RSP: 0018:ffffffff85a07e00 EFLAGS: 00000246
RAX: ffff8880e55dd000 RBX: 0000000000000000 RCX: ffffffff84bb95f7
RDX: ffffed100d9c630b RSI: 0000000000000004 RDI: ffffffff814c8304
RBP: dffffc0000000000 R08: 0000000000000000 R09: ffffed100d9c630a
R10: ffff88806ce31853 R11: 1ffff1100d9c6f7b R12: ffffffff8643ac50
R13: 1ffffffff0b40fc7 R14: 0000000000000000 R15: 0000000000000000
default_idle+0xe/0x20
default_idle_call+0x6d/0xb0
do_idle+0x344/0x490
cpu_startup_entry+0x4f/0x60
rest_init+0x164/0x290
start_kernel+0x3f9/0x510
x86_64_start_reservations+0x18/0x30
x86_64_start_kernel+0x109/0x120
common_startup_64+0x13e/0x148
irq event stamp: 7180982
hardirqs last enabled at (7180981): [] tick_nohz_idle_exit+0x1b5/0x360
hardirqs last disabled at (7180982): [] __schedule+0x16dd/0x3590
softirqs last enabled at (7180976): [] handle_softirqs+0x50c/0x770
softirqs last disabled at (7180959): [] __irq_exit_rcu+0xc4/0x100
---[ end trace 0000000000000000 ]---
percpu_ref_switch_to_atomic_rcu: percpu_ref_switch_to_atomic_rcu(): percpu_ref underflow slab kmalloc-64 start ffff888044680580 pointer offset 0 size 64
Bluetooth: hci8: unexpected cc 0x0c03 length: 249 > 1
Bluetooth: hci8: unexpected cc 0x1003 length: 249 > 9
Bluetooth: hci8: unexpected cc 0x1001 length: 249 > 9
Bluetooth: hci8: unexpected cc 0x0c23 length: 249 > 4
Bluetooth: hci8: unexpected cc 0x0c38 length: 249 > 2
unregister_netdevice: waiting for wlan0 to become free. Usage count = -61184
Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#2] SMP KASAN NOPTI
KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
CPU: 1 UID: 0 PID: 9063 Comm: modprobe Tainted: G D W 6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary)
Tainted: [D]=DIE, [W]=WARN
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
RIP: 0010:__queue_work+0x202/0x1240
Code: 48 8b 6d 00 e8 4f 9e 79 03 31 ff 41 89 c5 89 c6 e8 93 f3 31 00 45 85 ed 0f 85 e1 05 00 00 e8 55 f8 31 00 48 89 e8 48 c1 e8 03 <42> 80 3c 20 00 0f 85 a0 0e 00 00 4c 8b 75 00 48 89 df 4c 89 34 24
RSP: 0018:ffff88806cf08ca0 EFLAGS: 00010056
RAX: 0000000000000000 RBX: ffff888045804978 RCX: ffffffff8141ef1d
RDX: ffff888009751b80 RSI: ffffffff8141ef2b RDI: 0000000000000005
RBP: 0000000000000000 R08: 0000000000000000 R09: fffffbfff0f11ef4
R10: 0000000000000000 R11: 0000000000000000 R12: dffffc0000000000
R13: 0000000000000000 R14: 0000000000000001 R15: ffff8880174ab800
FS: 0000000000000000(0000) GS:ffff8880e56dd000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f1b25837260 CR3: 00000000377ec000 CR4: 0000000000350ef0
Call Trace:
call_timer_fn+0x188/0x590
__run_timers+0x4f6/0xab0
run_timer_softirq+0x117/0x210
handle_softirqs+0x1b1/0x770
__irq_exit_rcu+0xc4/0x100
irq_exit_rcu+0x9/0x20
sysvec_apic_timer_interrupt+0x70/0x80
asm_sysvec_apic_timer_interrupt+0x1a/0x20
RIP: 0010:unwind_next_frame+0xa5/0x2540
Code: 6f 48 4c 89 ea 48 89 04 24 48 c1 ea 03 48 b8 00 00 00 00 00 fc ff df 80 3c 02 00 0f 85 99 1a 00 00 49 8b 47 48 48 89 44 24 08 86 74 25 00 31 d2 45 31 c9 45 31 c0 48 8d 05 00 00 00 00 50 b9
RSP: 0018:ffff88801d7cf590 EFLAGS: 00000246
RAX: ffff88801d7cf7e8 RBX: 0000000000000001 RCX: 0000000000000001
RDX: 1ffff11003af9ec9 RSI: ffffffff81b34b3d RDI: ffff88801d7cf600
RBP: ffff88801d7cf658 R08: 0000000000000001 R09: ffff88801d7cf640
R10: 000000000003be53 R11: 0000000000025bdb R12: 0000000000000000
R13: ffff88801d7cf648 R14: ffff888009751b80 R15: ffff88801d7cf600
arch_stack_walk+0x86/0xf0
stack_trace_save+0x8e/0xc0
set_track_prepare+0x35/0x70
__alloc_object+0xf0/0x2c0
__create_object+0x1d/0x80
kmem_cache_alloc_noprof+0x414/0x690
vm_area_dup+0x25/0x6f0
__split_vma+0x179/0xde0
vma_modify+0xa9c/0x2030
vma_modify_flags+0x1b0/0x250
mprotect_fixup+0x1f4/0xba0
do_mprotect_pkey+0xa0f/0xd30
__x64_sys_mprotect+0x78/0xc0
do_syscall_64+0xbf/0x360
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f1b25888e27
Code: 44 00 00 b8 0b 00 00 00 0f 05 48 3d 01 f0 ff ff 73 01 c3 48 8d 0d 31 03 01 00 f7 d8 89 01 48 83 c8 ff c3 b8 0a 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8d 0d 11 03 01 00 f7 d8 89 01 48 83
RSP: 002b:00007ffe8400c608 EFLAGS: 00000206 ORIG_RAX: 000000000000000a
RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00007f1b25888e27
RDX: 0000000000000000 RSI: 0000000000238000 RDI: 00007f1b255c9000
RBP: 00007ffe8400c910 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000802 R11: 0000000000000206 R12: 00007f1b2585f510
R13: 00007ffe8400c610 R14: 0000000000000000 R15: 00007ffe8400c9a0
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:kasan_byte_accessible+0x15/0x30
Code: 00 00 0f 1f 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 66 0f 1f 00 48 b8 00 00 00 00 00 fc ff df 48 c1 ef 03 48 01 c7 <0f> b6 07 3c 07 0f 96 c0 e9 7e 15 0e 03 66 66 2e 0f 1f 84 00 00 00
RSP: 0018:ffff888016b079e8 EFLAGS: 00010082
RAX: dffffc0000000000 RBX: 0000000000000001 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffffffff84bddf4b RDI: e01ffbf11002c457
RBP: 00ffff88801622b8 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000020000 R11: 0000000000000001 R12: 0000000000000000
R13: ffffffff84bddf4b R14: 0000000000000000 R15: ffff88801bcab000
FS: 0000000000000000(0000) GS:ffff8880e56dd000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f1b25837260 CR3: 00000000377ec000 CR4: 0000000000350ef0
----------------
Code disassembly (best guess):
0: 00 00 add %al,(%rax)
2: 0f 1f 00 nopl (%rax)
5: 90 nop
6: 90 nop
7: 90 nop
8: 90 nop
9: 90 nop
a: 90 nop
b: 90 nop
c: 90 nop
d: 90 nop
e: 90 nop
f: 90 nop
10: 90 nop
11: 90 nop
12: 90 nop
13: 90 nop
14: 90 nop
15: 66 0f 1f 00 nopw (%rax)
19: 48 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%rax
20: fc ff df
23: 48 c1 ef 03 shr $0x3,%rdi
27: 48 01 c7 add %rax,%rdi
* 2a: 0f b6 07 movzbl (%rdi),%eax <-- trapping instruction
2d: 3c 07 cmp $0x7,%al
2f: 0f 96 c0 setbe %al
32: e9 7e 15 0e 03 jmpq 0x30e15b5
37: 66 data16
38: 66 data16
39: 2e cs
3a: 0f .byte 0xf
3b: 1f (bad)
3c: 84 00 test %al,(%rax)