Warning: Permanently added '[localhost]:31748' (ECDSA) to the list of known hosts. 2025/01/28 16:01:20 fuzzer started 2025/01/28 16:01:20 dialing manager at localhost:40187 syzkaller login: [ 61.360617] cgroup: Unknown subsys name 'net' [ 61.457489] cgroup: Unknown subsys name 'cpuset' [ 61.486000] cgroup: Unknown subsys name 'rlimit' [ 65.889915] kmemleak: 1 new suspected memory leaks (see /sys/kernel/debug/kmemleak) 2025/01/28 16:01:37 syscalls: 2217 2025/01/28 16:01:37 code coverage: enabled 2025/01/28 16:01:37 comparison tracing: enabled 2025/01/28 16:01:37 extra coverage: enabled 2025/01/28 16:01:37 setuid sandbox: enabled 2025/01/28 16:01:37 namespace sandbox: enabled 2025/01/28 16:01:37 Android sandbox: enabled 2025/01/28 16:01:37 fault injection: enabled 2025/01/28 16:01:37 leak checking: enabled 2025/01/28 16:01:37 net packet injection: enabled 2025/01/28 16:01:37 net device setup: enabled 2025/01/28 16:01:37 concurrency sanitizer: /sys/kernel/debug/kcsan does not exist 2025/01/28 16:01:37 devlink PCI setup: PCI device 0000:00:10.0 is not available 2025/01/28 16:01:37 USB emulation: enabled 2025/01/28 16:01:37 hci packet injection: enabled 2025/01/28 16:01:37 wifi device emulation: enabled 2025/01/28 16:01:37 802.15.4 emulation: enabled 2025/01/28 16:01:37 fetching corpus: 0, signal 0/0 (executing program) 2025/01/28 16:01:37 fetching corpus: 0, signal 0/0 (executing program) 2025/01/28 16:01:38 starting 8 fuzzer processes 16:01:38 executing program 0: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_SET_CCA_MODE(r0, &(0x7f0000001940)={&(0x7f0000001840)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000001900)={&(0x7f00000018c0)={0x14}, 0x14}}, 0x40) 16:01:38 executing program 4: syz_mount_image$msdos(&(0x7f0000000400), &(0x7f0000000440)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f00000006c0)) 16:01:38 executing program 1: openat$sr(0xffffffffffffff9c, &(0x7f0000000080), 0x101080, 0x0) 16:01:38 executing program 2: r0 = shmget(0x1, 0x3000, 0x0, &(0x7f0000ffc000/0x3000)=nil) shmctl$IPC_SET(r0, 0x1, &(0x7f00000005c0)={{0x2}}) 16:01:39 executing program 5: rename(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)='./file0\x00') 16:01:39 executing program 3: syz_open_dev$vcsu(&(0x7f0000000000), 0x0, 0x40) 16:01:39 executing program 6: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000004740)={0x0, 0x0, &(0x7f0000004700)={&(0x7f00000046c0)={0x28, 0x0, 0x1, 0x0, 0x0, {{}, {@val={0x8}, @val={0xc}}}}, 0x28}}, 0x0) [ 79.426186] audit: type=1400 audit(1738080099.049:7): avc: denied { execmem } for pid=273 comm="syz-executor.4" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=process permissive=1 16:01:39 executing program 7: syz_mount_image$vfat(&(0x7f00000001c0), &(0x7f0000000200)='./file0/file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) syz_mount_image$nfs4(&(0x7f0000000500), &(0x7f0000000540)='./file0\x00', 0x0, 0x0, &(0x7f0000000800), 0x20a042, &(0x7f00000008c0)) [ 80.856068] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 80.859013] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 80.865196] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 80.872362] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 80.877565] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 80.879782] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 80.887235] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 80.893836] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 80.898500] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 80.918580] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 80.923957] Bluetooth: hci1: unexpected cc 0x0c25 length: 249 > 3 [ 80.925801] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 80.936808] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 80.945608] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 80.950788] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 80.952455] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 80.964144] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 80.970315] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 80.979783] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 80.996051] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 80.999066] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1 [ 81.000737] Bluetooth: hci7: unexpected cc 0x0c03 length: 249 > 1 [ 81.003420] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9 [ 81.004701] Bluetooth: hci7: unexpected cc 0x1003 length: 249 > 9 [ 81.006995] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9 [ 81.008188] Bluetooth: hci7: unexpected cc 0x1001 length: 249 > 9 [ 81.011496] Bluetooth: hci2: unexpected cc 0x0c25 length: 249 > 3 [ 81.013668] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 81.016453] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4 [ 81.017686] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 81.021749] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 81.024588] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 81.028254] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 81.032190] Bluetooth: hci6: unexpected cc 0x0c25 length: 249 > 3 [ 81.034125] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2 [ 81.035387] Bluetooth: hci7: unexpected cc 0x0c23 length: 249 > 4 [ 81.043944] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 81.050642] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 81.053508] Bluetooth: hci3: unexpected cc 0x0c25 length: 249 > 3 [ 81.055464] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 81.061674] Bluetooth: hci7: unexpected cc 0x0c25 length: 249 > 3 [ 81.063845] Bluetooth: hci7: unexpected cc 0x0c38 length: 249 > 2 [ 81.080580] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 81.084416] Bluetooth: hci5: unexpected cc 0x0c25 length: 249 > 3 [ 81.090980] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 81.091665] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 81.106683] Bluetooth: hci4: unexpected cc 0x0c25 length: 249 > 3 [ 81.108577] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 82.942399] Bluetooth: hci0: command tx timeout [ 83.006035] Bluetooth: hci1: command tx timeout [ 83.071002] Bluetooth: hci2: command tx timeout [ 83.134033] Bluetooth: hci3: command tx timeout [ 83.134603] Bluetooth: hci5: command tx timeout [ 83.135511] Bluetooth: hci7: command tx timeout [ 83.136080] Bluetooth: hci6: command tx timeout [ 83.198934] Bluetooth: hci4: command tx timeout [ 84.990898] Bluetooth: hci0: command tx timeout [ 85.053991] Bluetooth: hci1: command tx timeout [ 85.117959] Bluetooth: hci2: command tx timeout [ 85.182062] Bluetooth: hci3: command tx timeout [ 85.182506] Bluetooth: hci5: command tx timeout [ 85.183320] Bluetooth: hci7: command tx timeout [ 85.183749] Bluetooth: hci6: command tx timeout [ 85.245929] Bluetooth: hci4: command tx timeout [ 87.037926] Bluetooth: hci0: command tx timeout [ 87.103105] Bluetooth: hci1: command tx timeout [ 87.166400] Bluetooth: hci2: command tx timeout [ 87.230008] Bluetooth: hci6: command tx timeout [ 87.230455] Bluetooth: hci7: command tx timeout [ 87.230929] Bluetooth: hci5: command tx timeout [ 87.231345] Bluetooth: hci3: command tx timeout [ 87.294891] Bluetooth: hci4: command tx timeout [ 89.085954] Bluetooth: hci0: command tx timeout [ 89.150435] Bluetooth: hci1: command tx timeout [ 89.213933] Bluetooth: hci2: command tx timeout [ 89.277958] Bluetooth: hci6: command tx timeout [ 89.278411] Bluetooth: hci3: command tx timeout [ 89.278837] Bluetooth: hci5: command tx timeout [ 89.279838] Bluetooth: hci7: command tx timeout [ 89.343906] Bluetooth: hci4: command tx timeout [ 136.491429] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 136.492170] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 136.773174] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 136.773829] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 137.462930] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 137.463591] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 137.723215] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 137.724069] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 16:02:37 executing program 1: openat$sr(0xffffffffffffff9c, &(0x7f0000000080), 0x101080, 0x0) 16:02:38 executing program 1: openat$sr(0xffffffffffffff9c, &(0x7f0000000080), 0x101080, 0x0) [ 138.575175] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 138.575808] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 16:02:38 executing program 1: openat$sr(0xffffffffffffff9c, &(0x7f0000000080), 0x101080, 0x0) [ 138.820972] ======================================================= [ 138.820972] WARNING: The mand mount option has been deprecated and [ 138.820972] and is ignored by this kernel. Remove the mand [ 138.820972] option from the mount to silence this warning. [ 138.820972] ======================================================= [ 138.826739] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 138.827374] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 16:02:38 executing program 7: syz_mount_image$vfat(&(0x7f00000001c0), &(0x7f0000000200)='./file0/file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) syz_mount_image$nfs4(&(0x7f0000000500), &(0x7f0000000540)='./file0\x00', 0x0, 0x0, &(0x7f0000000800), 0x20a042, &(0x7f00000008c0)) 16:02:38 executing program 1: syz_mount_image$vfat(&(0x7f00000001c0), &(0x7f0000000200)='./file0/file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) syz_mount_image$nfs4(&(0x7f0000000500), &(0x7f0000000540)='./file0\x00', 0x0, 0x0, &(0x7f0000000800), 0x20a042, &(0x7f00000008c0)) [ 139.081353] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 139.082054] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 16:02:38 executing program 1: syz_mount_image$vfat(&(0x7f00000001c0), &(0x7f0000000200)='./file0/file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) syz_mount_image$nfs4(&(0x7f0000000500), &(0x7f0000000540)='./file0\x00', 0x0, 0x0, &(0x7f0000000800), 0x20a042, &(0x7f00000008c0)) 16:02:38 executing program 7: syz_mount_image$vfat(&(0x7f00000001c0), &(0x7f0000000200)='./file0/file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) syz_mount_image$nfs4(&(0x7f0000000500), &(0x7f0000000540)='./file0\x00', 0x0, 0x0, &(0x7f0000000800), 0x20a042, &(0x7f00000008c0)) 16:02:38 executing program 1: syz_mount_image$vfat(&(0x7f00000001c0), &(0x7f0000000200)='./file0/file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) syz_mount_image$nfs4(&(0x7f0000000500), &(0x7f0000000540)='./file0\x00', 0x0, 0x0, &(0x7f0000000800), 0x20a042, &(0x7f00000008c0)) [ 139.317739] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 139.318394] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 139.454348] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 139.455066] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 139.915896] [ 139.916126] ====================================================== [ 139.916637] WARNING: possible circular locking dependency detected [ 139.917143] 6.13.0-next-20250128 #1 Not tainted [ 139.917780] ------------------------------------------------------ [ 139.919213] kworker/u8:0/11 is trying to acquire lock: [ 139.920269] ffffffff8621d9a8 (rtnl_mutex){+.+.}-{4:4}, at: unregister_netdevice_many_notify+0x1612/0x1c80 [ 139.922692] [ 139.922692] but task is already holding lock: [ 139.923885] ffff88800c128768 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: ieee80211_remove_interfaces+0xf2/0x6b0 [ 139.925837] [ 139.925837] which lock already depends on the new lock. [ 139.925837] [ 139.926491] [ 139.926491] the existing dependency chain (in reverse order) is: [ 139.927100] [ 139.927100] -> #1 (&rdev->wiphy.mtx){+.+.}-{4:4}: [ 139.927658] __mutex_lock+0x13d/0xb50 [ 139.928058] wiphy_register+0x1b2e/0x25d0 [ 139.928479] ieee80211_register_hw+0x23a4/0x3d60 [ 139.928938] mac80211_hwsim_new_radio+0x2759/0x4d60 [ 139.929427] init_mac80211_hwsim+0x389/0x870 [ 139.929886] do_one_initcall+0xf9/0x640 [ 139.930298] kernel_init_freeable+0x53d/0x7a0 [ 139.930748] kernel_init+0x1e/0x2d0 [ 139.931110] ret_from_fork+0x48/0x80 [ 139.931479] ret_from_fork_asm+0x1a/0x30 [ 139.931897] [ 139.931897] -> #0 (rtnl_mutex){+.+.}-{4:4}: [ 139.932416] __lock_acquire+0x29fd/0x4580 [ 139.932830] lock_acquire+0x19b/0x520 [ 139.933214] __mutex_lock+0x13d/0xb50 [ 139.933626] unregister_netdevice_many_notify+0x1612/0x1c80 [ 139.934176] unregister_netdevice_queue+0x224/0x2e0 [ 139.934661] _cfg80211_unregister_wdev+0x57b/0x700 [ 139.935127] ieee80211_remove_interfaces+0x2f2/0x6b0 [ 139.935603] ieee80211_unregister_hw+0x55/0x3a0 [ 139.936044] hwsim_exit_net+0x3a0/0x730 [ 139.936425] ops_exit_list+0xb3/0x180 [ 139.936791] cleanup_net+0x546/0xad0 [ 139.937159] process_one_work+0x8ee/0x1a10 [ 139.937606] worker_thread+0x674/0xe70 [ 139.938023] kthread+0x3ab/0x720 [ 139.938388] ret_from_fork+0x48/0x80 [ 139.938756] ret_from_fork_asm+0x1a/0x30 [ 139.939187] [ 139.939187] other info that might help us debug this: [ 139.939187] [ 139.939846] Possible unsafe locking scenario: [ 139.939846] [ 139.940342] CPU0 CPU1 [ 139.940732] ---- ---- [ 139.941122] lock(&rdev->wiphy.mtx); [ 139.941462] lock(rtnl_mutex); [ 139.941969] lock(&rdev->wiphy.mtx); [ 139.942512] lock(rtnl_mutex); [ 139.942820] [ 139.942820] *** DEADLOCK *** [ 139.942820] [ 139.943319] 4 locks held by kworker/u8:0/11: [ 139.943689] #0: ffff888008fdb948 ((wq_completion)netns){+.+.}-{0:0}, at: process_one_work+0x12b6/0x1a10 [ 139.944555] #1: ffff8880095dfd30 (net_cleanup_work){+.+.}-{0:0}, at: process_one_work+0x861/0x1a10 [ 139.945408] #2: ffffffff862119d0 (pernet_ops_rwsem){++++}-{4:4}, at: cleanup_net+0xca/0xad0 [ 139.946218] #3: ffff88800c128768 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: ieee80211_remove_interfaces+0xf2/0x6b0 [ 139.947113] [ 139.947113] stack backtrace: [ 139.947483] CPU: 1 UID: 0 PID: 11 Comm: kworker/u8:0 Not tainted 6.13.0-next-20250128 #1 [ 139.947520] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 139.947542] Workqueue: netns cleanup_net [ 139.947582] Call Trace: [ 139.947592] [ 139.947603] dump_stack_lvl+0xca/0x120 [ 139.947663] print_circular_bug+0x47b/0x750 [ 139.947709] check_noncircular+0x2e9/0x3c0 [ 139.947751] ? __pfx_check_noncircular+0x10/0x10 [ 139.947793] ? hlock_class+0x4e/0x130 [ 139.947823] ? mark_lock+0xac/0xed0 [ 139.947868] ? lockdep_lock+0x183/0x1b0 [ 139.947926] ? __pfx_lockdep_lock+0x10/0x10 [ 139.947988] __lock_acquire+0x29fd/0x4580 [ 139.948042] ? __pfx___lock_acquire+0x10/0x10 [ 139.948085] ? lock_release+0x20f/0x6f0 [ 139.948129] ? __pfx_lock_release+0x10/0x10 [ 139.948177] lock_acquire+0x19b/0x520 [ 139.948221] ? unregister_netdevice_many_notify+0x1612/0x1c80 [ 139.948270] ? __pfx_lock_acquire+0x10/0x10 [ 139.948315] ? srso_return_thunk+0x5/0x5f [ 139.948371] ? lock_release+0x20f/0x6f0 [ 139.948414] ? srso_return_thunk+0x5/0x5f [ 139.948470] ? lock_is_held_type+0x9e/0x120 [ 139.948525] ? srso_return_thunk+0x5/0x5f [ 139.948585] __mutex_lock+0x13d/0xb50 [ 139.948637] ? unregister_netdevice_many_notify+0x1612/0x1c80 [ 139.948683] ? unregister_netdevice_many_notify+0x1612/0x1c80 [ 139.948729] ? srso_return_thunk+0x5/0x5f [ 139.948785] ? synchronize_rcu_expedited+0x38a/0x420 [ 139.948829] ? __pfx___mutex_lock+0x10/0x10 [ 139.948884] ? __pfx_autoremove_wake_function+0x10/0x10 [ 139.948938] ? srso_return_thunk+0x5/0x5f [ 139.948994] ? kasan_quarantine_put+0x84/0x1e0 [ 139.949054] ? __pfx_wait_rcu_exp_gp+0x10/0x10 [ 139.949090] ? srso_return_thunk+0x5/0x5f [ 139.949150] unregister_netdevice_many_notify+0x1612/0x1c80 [ 139.949195] ? __virt_addr_valid+0x2e8/0x5d0 [ 139.949248] ? __pfx_lock_release+0x10/0x10 [ 139.949294] ? __pfx_unregister_netdevice_many_notify+0x10/0x10 [ 139.949340] ? find_held_lock+0x2c/0x110 [ 139.949398] ? srso_return_thunk+0x5/0x5f [ 139.949456] ? kernfs_remove_by_name_ns+0xc7/0x130 [ 139.949516] ? srso_return_thunk+0x5/0x5f [ 139.949582] ? lock_release+0x20f/0x6f0 [ 139.949626] ? __pfx_lock_release+0x10/0x10 [ 139.949669] ? srso_return_thunk+0x5/0x5f [ 139.949725] ? lockdep_hardirqs_on_prepare+0x262/0x3f0 [ 139.949772] ? srso_return_thunk+0x5/0x5f [ 139.949833] unregister_netdevice_queue+0x224/0x2e0 [ 139.949877] ? __pfx_unregister_netdevice_queue+0x10/0x10 [ 139.949921] ? up_write+0x195/0x520 [ 139.949976] _cfg80211_unregister_wdev+0x57b/0x700 [ 139.950029] ? srso_return_thunk+0x5/0x5f [ 139.950088] ieee80211_remove_interfaces+0x2f2/0x6b0 [ 139.950127] ? __pfx_ieee80211_remove_interfaces+0x10/0x10 [ 139.950166] ? srso_return_thunk+0x5/0x5f [ 139.950222] ? srso_return_thunk+0x5/0x5f [ 139.950277] ? synchronize_rcu+0x1ff/0x260 [ 139.950320] ieee80211_unregister_hw+0x55/0x3a0 [ 139.950365] hwsim_exit_net+0x3a0/0x730 [ 139.950407] ? __pfx_hwsim_exit_net+0x10/0x10 [ 139.950448] ? srso_return_thunk+0x5/0x5f [ 139.950504] ? netdev_run_todo+0x788/0x1040 [ 139.950553] ? __pfx_hwsim_exit_net+0x10/0x10 [ 139.950596] ops_exit_list+0xb3/0x180 [ 139.950638] cleanup_net+0x546/0xad0 [ 139.950683] ? __pfx_cleanup_net+0x10/0x10 [ 139.950737] process_one_work+0x8ee/0x1a10 [ 139.950802] ? __pfx_lock_acquire+0x10/0x10 [ 139.950847] ? __pfx_process_one_work+0x10/0x10 [ 139.950905] ? srso_return_thunk+0x5/0x5f [ 139.950961] ? move_linked_works+0x172/0x270 [ 139.951006] ? srso_return_thunk+0x5/0x5f [ 139.951062] ? assign_work+0x196/0x240 [ 139.951119] worker_thread+0x674/0xe70 [ 139.951178] ? lockdep_hardirqs_on_prepare+0x262/0x3f0 [ 139.951230] ? __pfx_worker_thread+0x10/0x10 [ 139.951295] kthread+0x3ab/0x720 [ 139.951346] ? __pfx_kthread+0x10/0x10 [ 139.951398] ? srso_return_thunk+0x5/0x5f [ 139.951454] ? finish_task_switch.isra.0+0x206/0x840 [ 139.951505] ? __pfx_kthread+0x10/0x10 [ 139.951559] ret_from_fork+0x48/0x80 [ 139.951590] ? __pfx_kthread+0x10/0x10 [ 139.951643] ret_from_fork_asm+0x1a/0x30 [ 139.951710] [ 140.110686] syz-executor.4 (280) used greatest stack depth: 23584 bytes left [ 142.152358] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 142.155991] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 142.159337] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 142.162212] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 142.165204] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 142.166254] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 142.284732] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 142.286395] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 142.289375] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 142.292121] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 142.292737] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 142.295203] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 142.298200] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 142.299583] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 142.300470] Bluetooth: hci2: unexpected cc 0x0c25 length: 249 > 3 [ 142.301504] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 142.302493] Bluetooth: hci4: unexpected cc 0x0c25 length: 249 > 3 [ 142.305064] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 142.349336] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 142.364750] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 142.388195] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 142.408203] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 142.410193] Bluetooth: hci5: unexpected cc 0x0c25 length: 249 > 3 [ 142.411389] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 142.416389] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1 [ 142.418166] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9 [ 142.427361] Bluetooth: hci7: unexpected cc 0x0c03 length: 249 > 1 [ 142.439986] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9 [ 142.452333] Bluetooth: hci7: unexpected cc 0x1003 length: 249 > 9 [ 142.459000] Bluetooth: hci7: unexpected cc 0x1001 length: 249 > 9 [ 142.477268] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4 [ 142.479422] Bluetooth: hci7: unexpected cc 0x0c23 length: 249 > 4 [ 142.481808] Bluetooth: hci6: unexpected cc 0x0c25 length: 249 > 3 [ 142.484459] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2 [ 142.486711] Bluetooth: hci7: unexpected cc 0x0c25 length: 249 > 3 [ 142.504015] Bluetooth: hci7: unexpected cc 0x0c38 length: 249 > 2 [ 144.189935] Bluetooth: hci0: command tx timeout [ 144.317896] Bluetooth: hci2: command tx timeout [ 144.382026] Bluetooth: hci4: command tx timeout [ 144.445945] Bluetooth: hci5: command tx timeout [ 144.573918] Bluetooth: hci7: command tx timeout [ 144.574349] Bluetooth: hci6: command tx timeout [ 146.238082] Bluetooth: hci0: command tx timeout [ 146.366456] Bluetooth: hci2: command tx timeout [ 146.429892] Bluetooth: hci4: command tx timeout [ 146.493978] Bluetooth: hci5: command tx timeout [ 146.621905] Bluetooth: hci6: command tx timeout [ 146.622330] Bluetooth: hci7: command tx timeout [ 148.285891] Bluetooth: hci0: command tx timeout [ 148.413879] Bluetooth: hci2: command tx timeout [ 148.478198] Bluetooth: hci4: command tx timeout [ 148.541887] Bluetooth: hci5: command tx timeout [ 148.669888] Bluetooth: hci7: command tx timeout [ 148.670316] Bluetooth: hci6: command tx timeout VM DIAGNOSIS: 16:02:39 Registers: info registers vcpu 0 RAX=ffff88802ccd8001 RBX=0000000000000001 RCX=0000000000000001 RDX=ffff88802ccd7a01 RSI=ffff88802ccd7ac0 RDI=ffff88802ccd7548 RBP=ffff88802ccd7590 RSP=ffff88802ccd74b0 R8 =ffffffff86ac780e R9 =ffff88802ccd7578 R10=000000000003ab8c R11=000000000008e195 R12=ffff88802ccd7598 R13=ffff88802ccd0000 R14=ffff88802ccd7ac8 R15=ffff88802ccd7538 RIP=ffffffff81348d51 RFL=00000282 [--S----] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =0000 0000000000000000 00000000 00000000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 00000000 00000000 FS =0000 0000000000000000 00000000 00000000 GS =0000 ffff88806ce00000 00000000 00000000 LDT=0000 fffffe0000000000 00000000 00000000 TR =0040 fffffe0000003000 00004087 00008b00 DPL=0 TSS64-busy GDT= fffffe0000001000 0000007f IDT= fffffe0000000000 00000fff CR0=80050033 CR2=00007f72db7236f4 CR3=00000000133ee000 CR4=00350ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001fa0 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 XMM00=00000000000000000000000000000000 XMM01=0000000000000000424276d5a3a80000 XMM02=00000000000000003fdcd42f80aea605 XMM03=000000c00000c9c0000000c00000fd68 XMM04=000000c00000ca40000000c00000fdb8 XMM05=000000c0003309d0000000c0003309c0 XMM06=000000c0003309f0000000c00000ca60 XMM07=000000c00000fdf0000000c00000caa0 XMM08=000000c00000fe78000000c00000fe70 XMM09=000000c00000fe88000000c00000fe80 XMM10=000000c00000fe98000000c00000fe90 XMM11=000000c00000fea8000000c00000fea0 XMM12=000000c00000feb8000000c00000feb0 XMM13=000000c00000fec8000000c00000fec0 XMM14=000000c00000fed8000000c00000fed0 XMM15=000000c00000fee8000000c00000fee0 info registers vcpu 1 RAX=0000000000000069 RBX=00000000000003f8 RCX=0000000000000000 RDX=00000000000003f8 RSI=ffffffff8283f415 RDI=ffffffff886970a0 RBP=ffffffff88697060 RSP=ffff8880095dec90 R8 =0000000000000000 R9 =ffffed1001dba046 R10=0000000000000069 R11=3038383866666666 R12=0000000000000069 R13=0000000000000010 R14=ffffffff88697060 R15=ffffffff8283f400 RIP=ffffffff8283f46d RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =0000 0000000000000000 00000000 00000000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 00000000 00000000 FS =0000 0000000000000000 00000000 00000000 GS =0000 ffff88806cf00000 00000000 00000000 LDT=0000 fffffe0000000000 00000000 00000000 TR =0040 fffffe000004a000 00004087 00008b00 DPL=0 TSS64-busy GDT= fffffe0000048000 0000007f IDT= fffffe0000000000 00000fff CR0=80050033 CR2=00007f386da7cef8 CR3=000000000c872000 CR4=00350ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 XMM00=7269762f736563697665642f7379732f XMM01=2f6b636f6c622f6c6175747269762f73 XMM02=ffffff0f0e0d0c0b0a09080706050403 XMM03=696e656420737365636341002f737973 XMM04=2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f XMM05=00005606e0cf577000005606e0d2f430 XMM06=00000000000000000000000300000000 XMM07=00000000000000000000000000000000 XMM08=2f63697361622f6372732f2e2e000d0a XMM09=00000000000000000000000000000000 XMM10=00000000000000000000000000000000 XMM11=00000000000000000000000000000000 XMM12=00000000000000000000000000000000 XMM13=00000000000000000000000000000000 XMM14=00000000000000000000000000000000 XMM15=00000000000000000000000000000000