Bluetooth: hci1: command 0x0406 tx timeout Bluetooth: hci7: command 0x0406 tx timeout rcu: INFO: rcu_preempt detected stalls on CPUs/tasks: rcu: 0-....: (92 ticks this GP) idle=017c/1/0x4000000000000000 softirq=270420/270420 fqs=18901 rcu: (detected by 1, t=105006 jiffies, g=188821, q=84521 ncpus=2) Sending NMI from CPU 1 to CPUs 0: NMI backtrace for cpu 0 CPU: 0 PID: 4640 Comm: syz-executor.2 Not tainted 6.4.0-next-20230706 #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 RIP: 0010:write_comp_data+0x21/0x90 Code: 90 90 90 90 90 90 90 90 90 49 89 f1 49 89 d2 49 89 f8 65 8b 05 88 51 b7 7e 89 c6 81 e6 00 01 00 00 65 48 8b 14 25 c0 8a 03 00 00 01 ff 00 74 0e 85 f6 74 59 8b 82 9c 14 00 00 85 c0 74 4f 8b RSP: 0018:ffff88806ce09510 EFLAGS: 00000006 RAX: 0000000000000303 RBX: ffff88806ce09840 RCX: ffffffff815f8487 RDX: ffff888042fc51c0 RSI: 0000000000000100 RDI: 0000000000000007 RBP: 0000000000000038 R08: 0000000000000007 R09: 0000000000000000 R10: 0000000000000020 R11: 0000000000000001 R12: ffff888008dfb570 R13: 0000000000000538 R14: 1ffff1100d9c12a8 R15: ffff88806ce34d88 FS: 00007f30ce74c700(0000) GS:ffff88806ce00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000100000000 CR3: 0000000009520000 CR4: 0000000000350ef0 Call Trace: perf_prepare_sample+0x1f7/0x2040 perf_event_output_forward+0xd7/0x3c0 __perf_event_overflow+0x4c2/0x9e0 perf_swevent_event+0x344/0x550 perf_tp_event+0x2dd/0x1280 perf_trace_run_bpf_submit+0xf3/0x190 perf_trace_preemptirq_template+0x252/0x420 trace_hardirqs_on+0xce/0x100 asm_sysvec_irq_work+0x1a/0x20 RIP: 0010:__rcu_read_unlock+0xc8/0x4f0 Code: b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 0f b6 04 02 84 c0 74 08 3c 03 0f 8e 76 01 00 00 8b 85 f8 03 00 00 85 c0 75 58 <65> 48 8b 1c 25 c0 8a 03 00 48 8d bb f4 03 00 00 48 b8 00 00 00 00 RSP: 0018:ffff88806ce09c20 EFLAGS: 00000206 RAX: 00000000001b3572 RBX: ffff88806ce3a2c0 RCX: ffffffff812cf90f RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffffff81375781 RBP: ffffffff856162c0 R08: 0000000000000001 R09: fffffbfff0ef9562 R10: ffffffff877cab17 R11: 0000000000000001 R12: 0000000000000001 R13: ffffffff83cb3900 R14: 0000000000000200 R15: ffff88806ce09cb0 __fib6_clean_all+0x140/0x290 fib6_run_gc+0x10e/0x2c0 call_timer_fn+0x17d/0x4e0 expire_timers+0x272/0x460 run_timer_softirq+0x2f5/0x880 __do_softirq+0x1b7/0x7d4 irq_exit_rcu+0x93/0xc0 sysvec_apic_timer_interrupt+0x6e/0x90 asm_sysvec_apic_timer_interrupt+0x1a/0x20 RIP: 0010:generic_exec_single+0x90/0x540 Code: e6 a0 92 04 0f 92 c3 31 ff 89 de e8 5a d9 0a 00 84 db 0f 84 f4 03 00 00 e8 8d dd 0a 00 4c 89 e6 89 ef 45 31 e4 e8 10 fb ff ff 7b dd 0a 00 44 89 e0 5b 5d 41 5c 41 5d 41 5e e9 db ee 12 03 e8 RSP: 0018:ffff88803b94fb10 EFLAGS: 00000202 RAX: 00000000000001fd RBX: 0000000000000200 RCX: ffffffff812cf90f RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffffff81416317 RBP: 0000000000000001 R08: 0000000000000001 R09: fffffbfff0ef9566 R10: ffffffff877cab37 R11: 0000000000000001 R12: 0000000000000000 R13: ffff88803b94fc38 R14: ffff88803b94fb88 R15: ffff888042fc51d4 smp_call_function_single+0x327/0x410 task_function_call+0xe5/0x180 perf_install_in_context+0x2cb/0x570 __do_sys_perf_event_open+0x18bf/0x2a60 do_syscall_64+0x3f/0x90 entry_SYSCALL_64_after_hwframe+0x6e/0xd8 RIP: 0033:0x7f30d11d6b19 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f30ce74c188 EFLAGS: 00000246 ORIG_RAX: 000000000000012a RAX: ffffffffffffffda RBX: 00007f30d12e9f60 RCX: 00007f30d11d6b19 RDX: ffffffffffffffff RSI: 0000000000000000 RDI: 0000000020000580 RBP: 00007f30d1230f6d R08: 0000000000000000 R09: 0000000000000000 R10: ffffffffffffffff R11: 0000000000000246 R12: 0000000000000000 R13: 00007ffd2acb815f R14: 00007f30ce74c300 R15: 0000000000022000 ---------------- Code disassembly (best guess): 0: 90 nop 1: 90 nop 2: 90 nop 3: 90 nop 4: 90 nop 5: 90 nop 6: 90 nop 7: 90 nop 8: 90 nop 9: 49 89 f1 mov %rsi,%r9 c: 49 89 d2 mov %rdx,%r10 f: 49 89 f8 mov %rdi,%r8 12: 65 8b 05 88 51 b7 7e mov %gs:0x7eb75188(%rip),%eax # 0x7eb751a1 19: 89 c6 mov %eax,%esi 1b: 81 e6 00 01 00 00 and $0x100,%esi 21: 65 48 8b 14 25 c0 8a mov %gs:0x38ac0,%rdx 28: 03 00 * 2a: a9 00 01 ff 00 test $0xff0100,%eax <-- trapping instruction 2f: 74 0e je 0x3f 31: 85 f6 test %esi,%esi 33: 74 59 je 0x8e 35: 8b 82 9c 14 00 00 mov 0x149c(%rdx),%eax 3b: 85 c0 test %eax,%eax 3d: 74 4f je 0x8e 3f: 8b .byte 0x8b