Bluetooth: hci0: command 0x041b tx timeout Bluetooth: hci0: command 0x040f tx timeout Bluetooth: hci0: command 0x0419 tx timeout syz-executor.0 (21072) used greatest stack depth: 23904 bytes left watchdog: BUG: soft lockup - CPU#0 stuck for 23s! [syz-executor.6:21073] Modules linked in: irq event stamp: 13934429 hardirqs last enabled at (13934428): [<ffffffff8440144a>] asm_sysvec_apic_timer_interrupt+0x1a/0x20 hardirqs last disabled at (13934429): [<ffffffff843bd71f>] sysvec_apic_timer_interrupt+0xf/0xc0 softirqs last enabled at (13916634): [<ffffffff8117fe6b>] __irq_exit_rcu+0x11b/0x180 softirqs last disabled at (13916637): [<ffffffff8117fe6b>] __irq_exit_rcu+0x11b/0x180 CPU: 0 PID: 21073 Comm: syz-executor.6 Not tainted 6.1.0-rc4-next-20221108 #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 RIP: 0010:__orc_find+0x6f/0xf0 Code: 72 4d 4c 89 e0 48 29 e8 48 89 c2 48 c1 e8 3f 48 c1 fa 02 48 01 d0 48 d1 f8 48 8d 5c 85 00 48 89 d8 48 c1 e8 03 42 0f b6 14 38 <48> 89 d8 83 e0 07 83 c0 03 38 d0 7c 04 84 d2 75 50 48 63 03 48 01 RSP: 0018:ffff88806d009720 EFLAGS: 00000212 RAX: 1ffffffff0bac32c RBX: ffffffff85d61960 RCX: ffffffff8347bea8 RDX: 0000000000000000 RSI: ffffffff8615cd42 RDI: ffffffff85d61960 RBP: ffffffff85d61960 R08: ffffffff8615cd42 R09: ffffffff85edad34 R10: ffffed100da0130a R11: 0000000000036001 R12: ffffffff85d61960 R13: ffffffff85d61960 R14: ffffffff85d61960 R15: dffffc0000000000 FS: 0000000000000000(0000) GS:ffff88806d000000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f77853d66f4 CR3: 000000000c2b0000 CR4: 0000000000350ef0 Call Trace: <IRQ> unwind_next_frame+0x2b1/0x2130 arch_stack_walk+0x87/0xf0 stack_trace_save+0x90/0xd0 set_track_prepare+0x74/0xd0 __create_object+0x378/0xc00 __kmem_cache_alloc_node+0x237/0x3d0 __kmalloc_node_track_caller+0x43/0xb0 __alloc_skb+0xe9/0x310 skb_copy+0x13d/0x3d0 mac80211_hwsim_tx_frame_no_nl.isra.0+0xb6d/0x1360 mac80211_hwsim_tx_frame+0x1ee/0x2a0 mac80211_hwsim_beacon_tx+0x566/0xab0 __iterate_interfaces+0x2d3/0x560 ieee80211_iterate_active_interfaces_atomic+0x74/0x180 mac80211_hwsim_beacon+0x105/0x200 __hrtimer_run_queues+0x541/0xb50 hrtimer_run_softirq+0x176/0x350 __do_softirq+0x1c7/0x8f9 __irq_exit_rcu+0x11b/0x180 irq_exit_rcu+0x9/0x30 sysvec_apic_timer_interrupt+0x92/0xc0 </IRQ> <TASK> asm_sysvec_apic_timer_interrupt+0x1a/0x20 RIP: 0010:unwind_next_frame+0xc9/0x2130 Code: 46 48 bf 01 00 00 00 48 89 44 24 10 e8 10 24 0f 00 48 b8 00 00 00 00 00 fc ff df 4d 8d 6e 60 4c 89 ea 48 c1 ea 03 80 3c 02 00 <0f> 85 ca 17 00 00 4d 8b 66 60 4d 85 e4 74 32 49 8d bc 24 88 00 00 RSP: 0018:ffff88803c11f228 EFLAGS: 00000246 RAX: dffffc0000000000 RBX: 0000000000000001 RCX: 1ffffffff0ef60e0 RDX: 1ffff11007823e61 RSI: ffffffff82c0a84d RDI: ffff888047a7e380 RBP: ffff88803c11f300 R08: ffffffff85f2db1e R09: ffffffff85f2db22 R10: ffffed1007823e62 R11: ffff88803c11f2e8 R12: ffff88803c11f370 R13: ffff88803c11f308 R14: ffff88803c11f2a8 R15: ffff88800837e8c0 arch_stack_walk+0x87/0xf0 stack_trace_save+0x90/0xd0 kasan_save_stack+0x22/0x50 __kasan_record_aux_stack+0x95/0xb0 __call_rcu_common.constprop.0+0x6a/0xa40 kmem_cache_free+0xc1/0x610 kernfs_put.part.0+0x2c7/0x540 kernfs_put+0x46/0x50 kernfs_remove_by_name_ns+0xbc/0x130 sysfs_unmerge_group+0xe7/0x170 dpm_sysfs_remove+0x7d/0xb0 device_del+0x210/0xfd0 unregister_netdevice_many_notify+0xc79/0x15e0 unregister_netdevice_queue+0x209/0x2c0 __tun_detach+0x1001/0x12f0 tun_chr_close+0xc8/0x190 __fput+0x263/0xa40 task_work_run+0x174/0x280 do_exit+0xa8e/0x2720 do_group_exit+0xd4/0x2a0 get_signal+0x21a5/0x22e0 arch_do_signal_or_restart+0x79/0x5a0 exit_to_user_mode_prepare+0x131/0x1a0 syscall_exit_to_user_mode+0x1d/0x50 do_syscall_64+0x4c/0x90 entry_SYSCALL_64_after_hwframe+0x72/0xdc RIP: 0033:0x7f2015c71b19 Code: Unable to access opcode bytes at 0x7f2015c71aef. RSP: 002b:00007f20131e7188 EFLAGS: 00000246 ORIG_RAX: 0000000000000039 RAX: fffffffffffffff4 RBX: 00007f2015d84f60 RCX: 00007f2015c71b19 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: 00007f2015ccbf6d R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007fff0f70044f R14: 00007f20131e7300 R15: 0000000000022000 </TASK> Sending NMI from CPU 0 to CPUs 1: NMI backtrace for cpu 1 CPU: 1 PID: 0 Comm: swapper/1 Not tainted 6.1.0-rc4-next-20221108 #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 RIP: 0010:queued_spin_lock_slowpath+0x128/0xc80 Code: 00 00 00 65 48 2b 04 25 28 00 00 00 0f 85 cd 0a 00 00 48 81 c4 88 00 00 00 5b 5d 41 5c 41 5d 41 5e 41 5f e9 ce 1f 00 00 f3 90 <e9> 71 ff ff ff 44 8b 74 24 48 41 81 fe 00 01 00 00 0f 84 e5 00 00 RSP: 0018:ffff88806d109a28 EFLAGS: 00000202 RAX: 0000000000000000 RBX: 0000000000000001 RCX: ffffffff843e067b RDX: fffffbfff0b088a5 RSI: 0000000000000004 RDI: ffffffff85844520 RBP: ffffffff85844520 R08: 0000000000000000 R09: ffffffff85844523 R10: fffffbfff0b088a4 R11: 0000000000000001 R12: 0000000000000003 R13: fffffbfff0b088a4 R14: 0000000000000001 R15: 1ffff1100da21346 FS: 0000000000000000(0000) GS:ffff88806d100000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f99de7002b8 CR3: 0000000009822000 CR4: 0000000000350ee0 Call Trace: <IRQ> do_raw_spin_lock+0x1e0/0x270 mac80211_hwsim_tx_frame_no_nl.isra.0+0x6f1/0x1360 mac80211_hwsim_tx_frame+0x1ee/0x2a0 mac80211_hwsim_beacon_tx+0x566/0xab0 __iterate_interfaces+0x2d3/0x560 ieee80211_iterate_active_interfaces_atomic+0x74/0x180 mac80211_hwsim_beacon+0x105/0x200 __hrtimer_run_queues+0x541/0xb50 hrtimer_run_softirq+0x176/0x350 __do_softirq+0x1c7/0x8f9 __irq_exit_rcu+0x11b/0x180 irq_exit_rcu+0x9/0x30 sysvec_apic_timer_interrupt+0x92/0xc0 </IRQ> <TASK> asm_sysvec_apic_timer_interrupt+0x1a/0x20 RIP: 0010:default_idle+0xf/0x20 Code: 42 03 fe cc cc cc cc cc cc cc cc 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa eb 07 0f 00 2d 33 9b 24 00 fb f4 <e9> 70 44 00 00 66 66 2e 0f 1f 84 00 00 00 00 00 90 90 90 90 90 90 RSP: 0018:ffff8880089f7e58 EFLAGS: 00000202 RAX: ffffffff843de240 RBX: ffff88800897d040 RCX: ffffffff843bec42 RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000 RBP: 0000000000000001 R08: 0000000000000001 R09: ffff88806d134cc3 R10: ffffed100da26998 R11: 0000000000000001 R12: ffffed100112fa08 R13: ffffffff85b0efd0 R14: 0000000000000000 R15: dffffc0000000000 default_idle_call+0x88/0xd0 do_idle+0x3bd/0x530 cpu_startup_entry+0x18/0x20 start_secondary+0x1cc/0x220 secondary_startup_64_no_verify+0xe0/0xeb </TASK> ---------------- Code disassembly (best guess): 0: 72 4d jb 0x4f 2: 4c 89 e0 mov %r12,%rax 5: 48 29 e8 sub %rbp,%rax 8: 48 89 c2 mov %rax,%rdx b: 48 c1 e8 3f shr $0x3f,%rax f: 48 c1 fa 02 sar $0x2,%rdx 13: 48 01 d0 add %rdx,%rax 16: 48 d1 f8 sar %rax 19: 48 8d 5c 85 00 lea 0x0(%rbp,%rax,4),%rbx 1e: 48 89 d8 mov %rbx,%rax 21: 48 c1 e8 03 shr $0x3,%rax 25: 42 0f b6 14 38 movzbl (%rax,%r15,1),%edx * 2a: 48 89 d8 mov %rbx,%rax <-- trapping instruction 2d: 83 e0 07 and $0x7,%eax 30: 83 c0 03 add $0x3,%eax 33: 38 d0 cmp %dl,%al 35: 7c 04 jl 0x3b 37: 84 d2 test %dl,%dl 39: 75 50 jne 0x8b 3b: 48 63 03 movslq (%rbx),%rax 3e: 48 rex.W 3f: 01 .byte 0x1