audit: type=1326 audit(1734540240.992:11): auid=0 uid=0 gid=0 ses=4 subj=system_u:system_r:kernel_t:s0 pid=17063 comm="syz-executor.6" exe="/syz-executor.6" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f1e3ef1eb19 code=0x0
Bluetooth: hci7: command 0x0406 tx timeout
Bluetooth: hci5: command 0x0406 tx timeout
watchdog: BUG: soft lockup - CPU#1 stuck for 22s! [syz-executor.4:17044]
Modules linked in:
irq event stamp: 2247999
hardirqs last enabled at (2247998): [<ffffffff84a7c70b>] irqentry_exit+0x3b/0x90
hardirqs last disabled at (2247999): [<ffffffff84a7b0cf>] sysvec_apic_timer_interrupt+0xf/0x80
softirqs last enabled at (2246768): [<ffffffff813a9aec>] handle_softirqs+0x50c/0x770
softirqs last disabled at (2246771): [<ffffffff813a9e84>] __irq_exit_rcu+0xc4/0x100
CPU: 1 UID: 0 PID: 17044 Comm: syz-executor.4 Not tainted 6.13.0-rc3-next-20241218 #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
RIP: 0010:lock_release+0xd5/0x6f0
Code: 00 48 c7 c5 34 d6 3f 86 48 b8 00 00 00 00 00 fc ff df 48 89 ea 48 c1 ea 03 0f b6 14 02 48 89 e8 83 e0 07 83 c0 03 38 d0 7c 08 <84> d2 0f 85 bd 04 00 00 44 8b 05 40 9a ef 04 45 85 c0 0f 84 10 03
RSP: 0018:ffff88806cf08d80 EFLAGS: 00000202
RAX: 0000000000000007 RBX: 1ffff1100d9e11b2 RCX: ffffffff81503bae
RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffff88806cf36250
RBP: ffffffff863fd634 R08: 0000000000000000 R09: fffffbfff0c7f912
R10: ffffffff863fc897 R11: 0000000000000003 R12: ffffffff85c16c00
R13: ffffffff81724836 R14: 000000000003a70c R15: ffffffff8483f67c
FS: 00007f26b9d1f700(0000) GS:ffff88806cf00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ffc7397eeb8 CR3: 000000003d03a000 CR4: 0000000000350ef0
Call Trace:
<IRQ>
__is_insn_slot_addr+0x13b/0x290
kernel_text_address+0x5b/0xc0
__kernel_text_address+0xd/0x40
unwind_get_return_address+0x59/0xa0
arch_stack_walk+0x9d/0xf0
stack_trace_save+0x8f/0xc0
kasan_save_stack+0x24/0x50
kasan_save_track+0x14/0x30
__kasan_kmalloc+0x7f/0x90
__kmalloc_noprof+0x1f7/0x4b0
ieee802_11_parse_elems_full+0xec/0x15a0
ieee80211_inform_bss+0xf4/0x10b0
cfg80211_inform_single_bss_data+0x801/0x1c70
cfg80211_inform_bss_data+0x20f/0x3510
cfg80211_inform_bss_frame_data+0x250/0x6a0
ieee80211_bss_info_update+0x2f6/0xa90
ieee80211_scan_rx+0x474/0xac0
ieee80211_rx_list+0x1e38/0x2840
ieee80211_rx_napi+0xdc/0x3b0
ieee80211_handle_queued_frames+0xd9/0x130
tasklet_action_common+0x235/0x3b0
handle_softirqs+0x1b1/0x770
__irq_exit_rcu+0xc4/0x100
irq_exit_rcu+0x9/0x20
sysvec_apic_timer_interrupt+0x70/0x80
</IRQ>
<TASK>
asm_sysvec_apic_timer_interrupt+0x1a/0x20
RIP: 0010:qlist_free_all+0x28/0x160
Code: 90 90 48 8b 07 48 85 c0 0f 84 41 01 00 00 41 57 41 56 41 55 49 89 fd 41 54 49 89 f4 55 53 eb 3e 48 63 95 c0 00 00 00 48 8b 18 <48> 89 ef 48 29 d0 48 89 c6 49 89 c6 e8 77 f0 ff ff 49 89 c7 66 90
RSP: 0018:ffff8880409779a0 EFLAGS: 00000246
RAX: ffff88800cfeab90 RBX: ffff88800cc52378 RCX: ffffea000033fa80
RDX: 0000000000000000 RSI: ffff888008c4f780 RDI: ffffffff81a46566
RBP: ffff888008c4f780 R08: 0000000000000001 R09: fffffbfff0fdf9e1
R10: ffffffff87efcf0f R11: 0000000000000000 R12: 0000000000000000
R13: ffff8880409779d8 R14: ffff88800d2a9000 R15: ffff88800d2a9000
kasan_quarantine_reduce+0x19f/0x240
__kasan_slab_alloc+0x49/0x70
kmem_cache_alloc_noprof+0x13d/0x3d0
__alloc_object+0x2f/0x270
__create_object+0x1d/0x80
kmem_cache_alloc_noprof+0x300/0x3d0
jbd2__journal_start+0x193/0x6b0
__ext4_journal_start_sb+0x331/0x600
ext4_file_write_iter+0xce8/0x18e0
vfs_write+0xbe2/0x10b0
ksys_write+0x122/0x240
do_syscall_64+0xbf/0x1d0
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f26bc7a9b19
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f26b9d1f188 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007f26bc8bcf60 RCX: 00007f26bc7a9b19
RDX: 0000000000140000 RSI: 0000000020000200 RDI: 0000000000000003
RBP: 00007f26bc803f6d R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007ffd49ceafaf R14: 00007f26b9d1f300 R15: 0000000000022000
</TASK>
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0 skipped: idling at default_idle+0x1e/0x30
loop6: detected capacity change from 0 to 2048
EXT4-fs (loop6): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
EXT4-fs (loop6): unmounting filesystem 00000000-0000-0000-0000-000000000000.
netlink: 8 bytes leftover after parsing attributes in process `syz-executor.0'.
loop6: detected capacity change from 0 to 2048
loop4: detected capacity change from 0 to 512
EXT4-fs (loop4): mounting ext2 file system using the ext4 subsystem
EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none.
EXT4-fs (loop6): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000.
loop4: detected capacity change from 0 to 512
EXT4-fs (loop4): mounting ext2 file system using the ext4 subsystem
EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none.
EXT4-fs (loop6): unmounting filesystem 00000000-0000-0000-0000-000000000000.
loop6: detected capacity change from 0 to 2048
EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000.
random: crng reseeded on system resumption
EXT4-fs (loop6): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
audit: type=1400 audit(1734540265.509:12): avc: denied { write } for pid=17178 comm="syz-executor.5" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=perf_event permissive=1
loop4: detected capacity change from 0 to 512
EXT4-fs (loop4): mounting ext2 file system using the ext4 subsystem
EXT4-fs (loop6): unmounting filesystem 00000000-0000-0000-0000-000000000000.
EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none.
EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000.
----------------
Code disassembly (best guess), 1 bytes skipped:
0: 48 c7 c5 34 d6 3f 86 mov $0xffffffff863fd634,%rbp
7: 48 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%rax
e: fc ff df
11: 48 89 ea mov %rbp,%rdx
14: 48 c1 ea 03 shr $0x3,%rdx
18: 0f b6 14 02 movzbl (%rdx,%rax,1),%edx
1c: 48 89 e8 mov %rbp,%rax
1f: 83 e0 07 and $0x7,%eax
22: 83 c0 03 add $0x3,%eax
25: 38 d0 cmp %dl,%al
27: 7c 08 jl 0x31
* 29: 84 d2 test %dl,%dl <-- trapping instruction
2b: 0f 85 bd 04 00 00 jne 0x4ee
31: 44 8b 05 40 9a ef 04 mov 0x4ef9a40(%rip),%r8d # 0x4ef9a78
38: 45 85 c0 test %r8d,%r8d
3b: 0f .byte 0xf
3c: 84 10 test %dl,(%rax)
3e: 03 .byte 0x3